Attesto.Federation.MetadataPolicy (Attesto v1.9.0)

Copy Markdown View Source

OpenID Federation 1.0 metadata-policy resolution and application.

Policies use string-keyed maps. apply/2 accepts either a complete metadata_policy Claim together with complete Entity metadata, or one Entity Type's parameter policy together with that Entity Type's metadata. merge/2 accepts the same two policy levels; its first argument is the policy of the more superior Entity.

Unknown, non-critical extension operators are ignored, as required by the Federation specification. Critical extension operators are handled while validating an Entity Statement and are outside this core seven-operator API.

Summary

Types

error()
policy()

Functions

apply(policy, metadata)

Apply a metadata policy in the standard operator order.

merge(policy_higher, policy_lower)

Merge a superior policy with the next lower policy in a Trust Chain.

Types

error()

@type error() :: :policy_error

policy()

@type policy() :: %{optional(String.t()) => term()}

Functions

apply(policy, metadata)

@spec apply(policy(), map()) :: {:ok, map()} | {:error, error()}

Apply a metadata policy in the standard operator order.

The return value contains no null metadata parameters. Unsupported value types, illegal operator combinations, and failed value checks are policy errors.

merge(policy_higher, policy_lower)

@spec merge(policy(), policy()) :: {:ok, policy()} | {:error, error()}

Merge a superior policy with the next lower policy in a Trust Chain.

The result is at least as restrictive as both inputs. Incompatible same-operator values or newly illegal operator combinations fail closed.