bindings/boxes_hash_hard_binding_validator.cc

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#include "bindings/boxes_hash_hard_binding_validator.h"

#include <cstdint>
#include <memory>
#include <utility>
#include <vector>

#include "absl/base/nullability.h"
#include "absl/container/flat_hash_map.h"
#include "absl/log/die_if_null.h"
#include "absl/status/status.h"
#include "absl/status/status_macros.h"
#include "absl/status/statusor.h"
#include "absl/strings/str_cat.h"
#include "absl/strings/string_view.h"
#include "absl/types/span.h"
#include "bindings/binding_hasher.h"
#include "bindings/boxes_hash_validator.h"
#include "constants/status_codes.h"
#include "formats/asset_box.h"
#include "formats/asset_byte_info.h"
#include "formats/byte_range.h"
#include "proto/assertion.pb.h"
#include "proto/boxes_hash_assertion.pb.h"
#include "proto/manifest.pb.h"
#include "proto/validation_result.pb.h"
#include "riegeli/bytes/reader.h"
#include "utils/dual_status_tracker.h"
#include "utils/status_tracker.h"
#include "validator/result.h"
#include "validator/validation_result_internal.h"

namespace credentio {

namespace {

class BoxesHashBindingHasherTracker : public BindingHasherTracker {
 public:
  explicit BoxesHashBindingHasherTracker(StatusTracker* tracker,
                                         absl::string_view hard_binding_uri)
      : tracker_(*ABSL_DIE_IF_NULL(tracker)),
        hard_binding_uri_(hard_binding_uri) {}
  void RecordMismatch() override {
    tracker_.RecordFailure(FailureStatusCode::kAssertionBoxesHashMismatch,
                           {.url = hard_binding_uri_});
  }
  void RecordMalformed() override {
    tracker_.RecordFailure(FailureStatusCode::kAssertionBoxesHashMalformed,
                           {.url = hard_binding_uri_});
  }
  void RecordAlgorithmUnsupported() override {
    tracker_.RecordFailure(FailureStatusCode::kAlgorithmUnsupported,
                           {.url = hard_binding_uri_});
  }
  void RecordGeneralError(absl::Status error) override {
    tracker_.RecordFailure(
        FailureStatusCode::kGeneralError,
        {.url = hard_binding_uri_, .explanation = error.message()});
  }

 private:
  StatusTracker& tracker_;
  absl::string_view hard_binding_uri_;
};

absl::Status AddInclusions(const AssetBox& asset_box,
                           absl::Span<const BoxExclusion> exclusions,
                           absl::string_view hard_binding_uri,
                           StatusTracker& tracker,
                           std::vector<BindingHasher::Chunk>& inclusions) {
  uint64_t last_handled_offset = asset_box.byte_range.offset;
  for (const auto& exclusion : exclusions) {
    uint64_t exclusion_asset_offset =
        asset_box.byte_range.offset + exclusion.start();

    if (exclusion.start() >= asset_box.byte_range.length ||
        exclusion.length() >
            (asset_box.byte_range.length - exclusion.start())) {
      // Exclusion starts after the box or extends beyond the end of the box.
      tracker.RecordFailure(
          FailureStatusCode::kAssertionBoxesHashMalformed,
          {.url = hard_binding_uri,
           .explanation = "Exclusion starts after the box or extends beyond "
                          "the end of the box"});
      return absl::InvalidArgumentError(
          "Exclusion starts after the box or extends beyond the end of the "
          "box");
    }

    if (last_handled_offset < exclusion_asset_offset) {
      inclusions.push_back({
          .op = BindingHasher::Chunk::Op::kInclusion,
          .offset = last_handled_offset,
          .length = static_cast<int64_t>(exclusion_asset_offset) -
                    static_cast<int64_t>(last_handled_offset),
      });
    }
    last_handled_offset = exclusion_asset_offset + exclusion.length();
  }
  if (last_handled_offset <
      (asset_box.byte_range.offset + asset_box.byte_range.length)) {
    inclusions.push_back({
        .op = BindingHasher::Chunk::Op::kInclusion,
        .offset = last_handled_offset,
        .length = static_cast<int64_t>(asset_box.byte_range.offset +
                                       asset_box.byte_range.length) -
                  static_cast<int64_t>(last_handled_offset),
    });
  }
  return absl::OkStatus();
}

}  // namespace

absl::StatusOr<std::unique_ptr<ValidationResultProto>>
BoxesHashHardBindingValidator::Validate(
    riegeli::Reader& contents, const AssetByteInfo& asset_byte_info,
    std::unique_ptr<PartialValidationResultProto> partial_validation_result)
    const {
  const Assertion* absl_nullable assertion =
      GetAssertion(partial_validation_result.get(),
                   partial_validation_result->hard_binding_uri());
  if (assertion == nullptr) {
    return absl::InvalidArgumentError(absl::StrCat(
        "missing assertion: ", partial_validation_result->hard_binding_uri()));
  }
  if (!assertion->has_boxes_hash()) {
    return absl::InvalidArgumentError(
        absl::StrCat("assertion is not a boxes hash assertion: ",
                     partial_validation_result->hard_binding_uri()));
  }

  ABSL_ASSIGN_OR_RETURN(auto tracker,
                        DualStatusTracker::FromPartialValidationResult(
                            partial_validation_result.get()));

  Validate(contents, asset_byte_info.boxes, assertion->boxes_hash(),
           partial_validation_result->hard_binding_uri(), *tracker);

  return MakeFullValidationResult(std::move(partial_validation_result));
}

void BoxesHashHardBindingValidator::Validate(
    riegeli::Reader& contents, std::vector<AssetBox> contents_boxes,
    const BoxesHashAssertion& assertion, absl::string_view hard_binding_uri,
    StatusTracker& tracker) const {
  if (!BoxesHashValidator(assertion, hard_binding_uri,
                          /*claims_algo=*/"", tracker)
           .Validate()
           .ok()) {
    return;
  }

  // Needed to determine "unknown box" vs "out of order box"
  absl::flat_hash_map<absl::string_view, uint64_t> box_counts;
  for (const auto& box : contents_boxes) {
    box_counts[box.identifier] += 1;
  }

  int asset_box_index = 0;
  for (const auto& assertion_box_map : assertion.boxes()) {
    auto algorithm(assertion_box_map.alg());
    if (algorithm.empty()) {
      algorithm = assertion.alg();
    }

    std::vector<BindingHasher::Chunk> inclusions;
    for (int box_name_idx = 0; box_name_idx < assertion_box_map.names_size();
         ++box_name_idx) {
      const absl::string_view assertion_box_name =
          assertion_box_map.names(box_name_idx);

      if (asset_box_index >= contents_boxes.size()) {
        // Additional boxes in the assertion that are not in the asset.
        tracker.RecordFailure(FailureStatusCode::kAssertionBoxesHashMismatch,
                              {.url = hard_binding_uri});
        return;
      }

      const auto& current_asset_box = contents_boxes[asset_box_index];
      if (current_asset_box.identifier != assertion_box_name) {
        tracker.RecordFailure(
            box_counts[assertion_box_name] > 0
                ? FailureStatusCode::kAssertionBoxesHashMismatch
                : FailureStatusCode::kAssertionBoxesHashUnknownBox,
            {.url = hard_binding_uri});
        return;
      }
      --box_counts[assertion_box_name];

      if (assertion_box_name != "C2PA") {
        std::vector<BoxExclusion> exclusions;
        if (!assertion_box_map.excluded()) {
          for (const auto& exclusion : assertion_box_map.exclusions()) {
            if (exclusion.has_box_index() &&
                exclusion.box_index() > box_name_idx) {
              // Exclusion is for a box further down the line.
              break;
            }
            if (!exclusion.has_box_index() ||
                exclusion.box_index() == box_name_idx) {
              exclusions.push_back(exclusion);
            }
          }
        }

        if (!AddInclusions(current_asset_box, exclusions, hard_binding_uri,
                           tracker, inclusions)
                 .ok()) {
          return;
        }
      }
      ++asset_box_index;
    }
    BoxesHashBindingHasherTracker boxes_hash_tracker(&tracker,
                                                     hard_binding_uri);
    if (!inclusions.empty()) {
      auto hasher = BindingHasher::Create(algorithm, std::move(inclusions),
                                          boxes_hash_tracker);
      if (hasher == nullptr) {
        return;
      }
      auto digest = hasher->Digest(contents, boxes_hash_tracker);
      if (!digest.has_value()) {
        tracker.RecordFailure(
            FailureStatusCode::kGoogleInternalError,
            {.url = hard_binding_uri, .explanation = "Digest failed"});
        return;
      }
      // If the box_set is excluded, we don't care if the hash matches, just
      // that it can be hashed.
      bool required =
          !(assertion_box_map.has_excluded() && assertion_box_map.excluded());
      if (required && *digest != assertion_box_map.hash()) {
        tracker.RecordFailure(FailureStatusCode::kAssertionBoxesHashMismatch,
                              {.url = hard_binding_uri});
        return;
      }
    }
  }
  if (asset_box_index < contents_boxes.size()) {
    // Additional boxes in the asset that are not in the assertion.
    tracker.RecordFailure(FailureStatusCode::kAssertionBoxesHashUnknownBox,
                          {.url = hard_binding_uri});
    return;
  }
  tracker.RecordSuccess(SuccessStatusCode::kAssertionBoxesHashMatch,
                        {.url = hard_binding_uri});
}

}  // namespace credentio