RFC 9421 Section 5 signature requests and nonce challenges.
parse/2 accepts one field value or ordered field occurrences, with explicit
target: :request | :response. It returns ordered requests, each a map with
:label, :components (a metadata-free Structured Fields Inner List), and
:parameters (a map). Created/expires requests must be bare true; nonce,
keyid, tag, and alg must be strings. Algorithms are exact HTTP registry tokens,
never JWS selections. Unknown parameters reject. Components include their
exact parameters; request targets cannot cover @status or related requests.
Response targets require req for request-derived components.
serialize/1 writes a deterministic dictionary. fulfill/5 validates the
target and asks an arity-one chooser for {:ok, %{algorithm: algorithm, created: integer_or_nil, expires: integer_or_nil}} or :error. Requested alg
must agree; keyid, nonce, and tag are copied verbatim. Requested times come
from the chooser. Signatures are appended in request order via
RequestSeal.sign/4 and its caller signer; options are its :field_schemas.
The chooser and signer own custody. Unavailable components or choices reject
with :negotiation_unfulfillable, without a partial message.
Passing requests as accept_signature: to RequestSeal.verify_quorum/3
requires each exact label in the verified, selector-eligible pool after key-unit
filtering, with the same covered component identity set and every requested
parameter. The label need not be assigned to a counted slot; it appears in
qualifying and signatures only when assigned. Extra metadata and separate
signatures are allowed.
A challenge match is established; replay storage and authorization are not.
Limits: 16 requests, 65,536 wire bytes, and the signature-base component bounds.
Summary
Functions
Fulfill requests in order through caller-owned key selection and signing.
Parse ordered signature requests for an explicit target message kind.
Serialize ordered requests with deterministic signature metadata ordering.
Types
@type request() :: %{ label: binary(), components: RequestSeal.StructuredFields.Value.t(), parameters: %{optional(binary()) => true | binary()} }
Functions
@spec fulfill( RequestSeal.Message.t(), [request()], (request() -> {:ok, map()} | :error), RequestSeal.Policy.signer(), keyword() ) :: {:ok, RequestSeal.Message.t()} | {:error, RequestSeal.Error.t()}
Fulfill requests in order through caller-owned key selection and signing.
@spec parse(binary() | [binary()], keyword()) :: {:ok, [request()]} | {:error, RequestSeal.Error.t()}
Parse ordered signature requests for an explicit target message kind.
@spec serialize([request()]) :: {:ok, binary()} | {:error, RequestSeal.Error.t()}
Serialize ordered requests with deterministic signature metadata ordering.