Module delegation 

Scoped certificate delegation templates.

When a parent cert delegates bounded authority to a child cert, the child can issue/sign artifacts only within the delegated scope. This crate provides the scope types and validation logic.

Example: OIML CNML Manufacturer Model Cert delegates to manufacturer the right to issue Instance Certs for a specific instrument model only.

See TODO.roadmap/32-cert-delegation-cms-xmldsig.md for the full spec.

Structs

DelegationScope

The full scope of a delegated authority.

DelegationValidation

Result of a delegation validation.

EncryptSpec

Spec for Encrypt operations.

SignCertSpec

Spec for SignCert operations.

SignDocSpec

Spec for SignDocument operations.

ThresholdSignSpec

Spec for ThresholdSign operations.

Enums

Constraint

A constraint on delegated authority.

DenialReason

Why an operation was denied.

Operation

An operation that a delegated child cert is authorized to perform.

ScopeValue

A scope value extracted from a child artifact, checked against constraints.

SignatureFormat

Permitted signature format.

Functions

validate_delegation

Validate whether proposed_operation is permitted under scope, given the actual_values that apply.