Method run

atomic-cli/src/commands/intent/verify.rs:32–98

(&self)

impl Command for IntentVerify {
    fn run(&self) -> CliResult<()> {
        let root = find_repository_root()?;
        let repo = Repository::open(&root).map_err(CliError::Repository)?;

        let inputs = bridge::read_intent(&repo, &self.id)?;
        let node = match bridge::load_attestation(&repo, &self.id, &inputs)? {
            bridge::Attestation::None => {
                return Err(CliError::InvalidArgument {
                    message: format!(
                        "no attestation found for {}; run `atomic intent attest {}` first",
                        self.id, self.id
                    ),
                })
            }
            bridge::Attestation::Stale(_) => {
                return Err(CliError::InvalidArgument {
                    message: format!(
                        "the attestation for {} is stale (the intent changed since it was \
                         signed); re-run `atomic intent attest {}`",
                        self.id, self.id
                    ),
                })
            }
            bridge::Attestation::Fresh(node) => *node,
        };

        // Resolve the public key to verify against. `did:atomic` is a key
        // fingerprint (not recoverable to a key), so a store-backed resolver is
        // needed; for now we verify against the default (or named) identity and
        // let atomic_canonical::verify's DID check catch a mismatch.
        let store = IdentityStore::open_default().map_err(|e| {
            CliError::Internal(anyhow::anyhow!("Failed to open identity store: {}", e))
        })?;
        let identity = if let Some(name) = &self.identity {
            store
                .load_by_name(name)
                .map_err(|_| CliError::IdentityNotFound(name.clone()))?
        } else {
            store
                .get_default()
                .map_err(|e| {
                    CliError::Internal(anyhow::anyhow!("Failed to load default identity: {}", e))
                })?
                .ok_or_else(|| CliError::InvalidArgument {
                    message: "No default identity set. Create one first:\n  \
                              atomic identity new <name> --email <email> --set-default"
                        .to_string(),
                })?
        };

        verify(&node, &identity.public_key).map_err(|e| CliError::InvalidArgument {
            message: format!(
                "verification failed: {e} (if this intent was attested by a different \
                 identity, pass --identity <name>)"
            ),
        })?;

        println!("Verified intent: {}", self.id);