Function: verifyFederation()
verifyFederation(
options):Promise<FederationVerification>
Defined in: packages/federation-verify/src/verify.ts:255
Verifies an entity's trust chain from published documents alone, and returns the whole report with its verdict.
It never throws for anything a federation or a network can do: a failed check is
not_verified, an unobtainable document is could_not_check, and a document shaped
in a way no check foresaw is recorded as could-not-check too, because the verifier
failing is not the federation failing. It throws only on a caller's mistake: an
entityId or expectedAnchor that is not an entity identifier (ENTITY_ID),
found before anything is fetched.
What it checks, for every statement in the chain: the media type, the JWS typ
(entity-statement+jwt), alg ES256 and a kid; the signature (a configuration by
a key in its own jwks, a subordinate statement by a key in its issuer's
configuration); iss and sub; exp in the future and iat not, with a minute of
tolerance; the key link between a configuration and its superior's statement about
it; and constraints. Then the anchor against expectedAnchor and
pinnedAnchorKeys, and unless chainOnly its governance framework. It does not
resolve metadata policy or trust marks, and it follows only the first of several
authority_hints.
Parameters
options
Returns
Promise<FederationVerification>