claim/validator.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CLAIM_VALIDATOR_H_
#define THIRD_PARTY_CREDENTIO_CLAIM_VALIDATOR_H_

#include <optional>
#include <string>
#include <vector>

#include "absl/log/die_if_null.h"
#include "cbor/cbor.h"
#include "cose/verifier.h"
#include "jumbf/box.h"
#include "proto/assertion.pb.h"
#include "proto/manifest.pb.h"
#include "validator/tracker.h"

namespace credentio {

class ClaimValidator {
 public:
  virtual ~ClaimValidator() = default;
  // Parses and validates a `Claim` JUMBF box of the provided `Manifest` JUMBF,
  // recording status codes in the provided tracker. If the validation is
  // successful, returns a `Claim` proto containing the validated claim.
  virtual std::optional<Claim> Validate(
      const jumbf::SuperBox& manifest,
      ValidationTracker& validation_tracker) const = 0;
};

class ClaimValidatorImpl : public ClaimValidator {
 public:
  explicit ClaimValidatorImpl(const CoseVerifier* cose_verifier)
      : cose_verifier_(*ABSL_DIE_IF_NULL(cose_verifier)) {}
  ~ClaimValidatorImpl() override = default;
  // Parses and validates a `Claim` JUMBF box of the provided `Manifest` JUMBF,
  // recording status codes in the provided tracker. If the validation is
  // successful, returns a `Claim` proto containing the validated claim.
  std::optional<Claim> Validate(
      const jumbf::SuperBox& manifest,
      ValidationTracker& validation_tracker) const override;

 private:
  // Holder for created, gathered and redacted assertion URIs inside the claim.
  struct AssertionUris {
    std::optional<std::string> default_algorithm;
    std::optional<cbor::ArrayView> created_assertions;
    std::optional<cbor::ArrayView> gathered_assertions;
    std::optional<cbor::ArrayView> redacted_assertions;
  };

  struct ValidateAssertionResult {
    std::vector<credentio::HashedUri> created_assertions;
    std::vector<credentio::HashedUri> gathered_assertions;
    std::vector<std::string> redacted_assertions;
  };

  // Extracts hashed assertion URIs from the Claim. Records the C2PA failure
  // status codes in the provided tracker.
  //
  // Returns a set of URI lists for created, gathered and redacted assertions.
  ValidateAssertionResult ValidateAssertions(
      const AssertionUris& assertion_uris,
      ValidationTracker& validation_tracker) const;
  const CoseVerifier& cose_verifier_;
};

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_CLAIM_VALIDATOR_H_