bindings/boxes_hash_validator.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_BINDINGS_BOXES_HASH_VALIDATOR_H_
#define THIRD_PARTY_CREDENTIO_BINDINGS_BOXES_HASH_VALIDATOR_H_

#include "absl/status/status.h"
#include "absl/strings/string_view.h"
#include "constants/status_codes.h"
#include "proto/boxes_hash_assertion.pb.h"
#include "utils/status_tracker.h"

namespace credentio {

// Validates the structure of a BoxesHashAssertion. Only things such as the
// presence of required fields, and ranges are validated. The hash values are
// not validated.
class BoxesHashValidator {
 public:
  explicit BoxesHashValidator(const BoxesHashAssertion& assertion,
                              absl::string_view hard_binding_uri,
                              absl::string_view claims_algo,
                              StatusTracker& tracker)
      : assertion_(assertion),
        hard_binding_uri_(hard_binding_uri),
        claims_algo_(claims_algo),
        tracker_(tracker) {}

  // Validates the structure of the BoxesHashAssertion. Returns an
  // InvalidArgumentError if the structure is invalid. This method should be
  // called before attempting to validate the hashes contained in this
  // assertion.
  absl::Status Validate();

 private:
  // Helper method to log a failure code and explanation to the tracker, and
  // return an InvalidArgumentError.
  absl::Status LogFailure(FailureStatusCode failure_code,
                          absl::string_view explanation);

  // Helper method to log an informational code to the tracker if additional
  // exclusions are present in the assertion.
  void LogAdditionalExclusionsPresent();

  // Validates a single box hash map in the assertion.
  absl::Status ValidateBoxHashMap(const BoxHash& box_hash_map);

  // Validates an excluded box hash map in the assertion.
  absl::Status ValidateExclusion(const BoxHash& box_hash_map,
                                 bool contains_c2pa_box);

  // Validates a box hash map with exclusion ranges in the assertion.
  absl::Status ValidateExclusionRanges(const BoxHash& box_hash_map,
                                       bool contains_c2pa_box);

  const BoxesHashAssertion& assertion_;
  absl::string_view hard_binding_uri_;
  absl::string_view claims_algo_;
  StatusTracker& tracker_;
  bool found_additional_exclusions_ = false;
};

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_BINDINGS_BOXES_HASH_VALIDATOR_H_