Function admit_document

atomic-canonical/src/jcs.rs:102–120

Admit a JSON document that arrived as bytes, and return the value it denotes. The refusals are the point. A repeated member name gives one document two readings: two parties take the same bytes for two different documents and a signature over either reading verifies, and by the time a `serde_json::Value` exists the repeat is gone. Nesting past [`MAX_DEPTH`] containers is refused here rather than

(bytes: &[u8])

/// admitted bytes then fail to deserialize, which is a disagreement between the
/// admission layer and `serde_json` rather than a statement about the input.
pub fn admit_document(bytes: &[u8]) -> Result<Value> {
    jcs_admit::admit_with(bytes, &ADMISSION)?;

    // Sound only because the admission above has already walked these bytes and
    // refused anything nested past MAX_DEPTH. serde_json's own recursion limit
    // is switched off so the declared cap is the only cap: left on, it refuses
    // at 128 while the admission admits 128, and a document this crate encodes
    // is one it will not read back. This parse MUST stay ordered after
    // `admit_with`. Parsed first, an input nested far enough would overflow
    // the stack instead of returning an error.
    let not_deserializable = |e: serde_json::Error| {
        CanonicalError::Proof(format!("admitted document does not deserialize: {e}"))
    };
    let mut de = serde_json::Deserializer::from_slice(bytes);
    de.disable_recursion_limit();
    let value = Value::deserialize(&mut de).map_err(not_deserializable)?;
    de.end().map_err(not_deserializable)?;
    Ok(value)
}

/// Canonicalize a JSON value into its RFC-8785 string form.
pub fn canonicalize(value: &Value) -> String {