Verify a proof in Rust

Guide / Rust

Most embedded Rust integrations start with auths_proof::Engine::verify_cbor. The operation accepts exactly three canonical CBOR byte strings: proof, action, and trusted context.

1. Add the facade crate.

   Cargo.toml

   [dependencies]
   auths-proof = { version = "0.1.0", default-features = false }

2. Construct one immutable executable registry.

   use auths_proof::{registries::ImmutableRegistries, Engine};
   
   let registries = ImmutableRegistries::target_v1(/* installed adapters */)?;
   let engine = Engine::new(registries);

   The exact registry constructor depends on the principal methods and policy implementations installed by your application. Registries are fixed at engine construction.

3. Verify the three portable inputs.

   let result = engine.verify_cbor(
       &proof_cbor,
       &canonical_action_cbor,
       &trusted_context_cbor,
   )?;
   
   match result.verdict() {
       auths_proof::Verdict::Authorized => {
           // Decode and execute the verified action through its profile.
       }
       auths_proof::Verdict::Denied | auths_proof::Verdict::Indeterminate => {
           let explanation = result.explanation();
           report(explanation.code(), explanation.message());
       }
   }

Current source surface

The facade documents Engine::verify_cbor as the usual entry point. Lower-level typed verification is available for Rust profile decoders through Engine::verify_typed.

Protocol outcomes are values

Malformed or unauthorized input produces a canonical verification result. CodecError from verify_cbor means the engine could not encode or decode its own result, not that the proof was denied.

Before executing

An application integration should normally use the downstream auths-sdk, which pairs verification with profile-decoded commands. Never verify one action and then execute values taken from the caller’s original request.