Method valid

mlspp/src/state.cpp:1472–1533

///

bool
State::valid(const LeafNode& leaf_node,
             LeafNodeSource required_source,
             std::optional<LeafIndex> index) const
{
  // Verify that the credential in the LeafNode is valid as described in Section
  // 5.3.1.
  // XXX(RLB) N/A, no credential validation in the library right now

  // Verify the leaf_node_source field:
  const auto correct_source = (leaf_node.source() == required_source);

  // Verify that the signature on the LeafNode is valid using signature_key.
  auto binding = std::optional<LeafNode::MemberBinding>{};
  switch (required_source) {
    case LeafNodeSource::commit:
    case LeafNodeSource::update:
      binding = LeafNode::MemberBinding{ _group_id, opt::get(index) };
      break;

    default:
      // Nothing to do
      break;
  }

  const auto signature_valid = leaf_node.verify(_suite, binding);

  // Verify that the LeafNode is compatible with the group's parameters. If the
  // GroupContext has a required_capabilities extension, then the required
  // extensions, proposals, and credential types MUST be listed in the
  // LeafNode's capabilities field.
  const auto supports_group_extensions =
    leaf_node.verify_extension_support(_extensions);

  // TODO(RLB) Verify the lifetime field

  // Verify that the credential type is supported by all members of the group,
  // as specified by the capabilities field of each member's LeafNode, and that
  // the capabilities field of this LeafNode indicates support for all the
  // credential types currently in use by other members.
  //
  // Verify that the following fields are unique among the members of the group:
  //   signature_key
  //   encryption_key
  //
  // Note: Uniqueness of signature and encryption keys is assured by the
  // tree operations (add/update), so we do not need to verify those here.
  const auto mutual_credential_support =
    _tree.all_leaves([&](auto /* i */, const auto& leaf) {
      return leaf.capabilities.credential_supported(leaf_node.credential) &&
             leaf_node.capabilities.credential_supported(leaf.credential);
    });

  // Verify that the extensions in the LeafNode are supported by checking that
  // the ID for each extension in the extensions field is listed in the
  // capabilities.extensions field of the LeafNode.
  auto supports_own_extensions =
    leaf_node.verify_extension_support(leaf_node.extensions);