Struct ApiVisibilityComparator 

pub struct ApiVisibilityComparator { /* private fields */ }

Pure canonicalizer and comparator for two authorized API response views.

Object keys are compared in UTF-8 byte order, so input map insertion order never changes a signature. Array position and duplicate elements remain meaningful. Fields compares only key/schema structure, Resources compares the complete canonical JSON value, and Status compares the exact validated HTTP status.

JSON-number text follows the pinned serde_json implementation. Signatures are deterministic within this comparator version, but are not a permanent cross-version wire-hash promise; persisted replay data should record the comparator version and dependency set.

Comparison itself reads no clock. The caller supplies both a stable observation identity and observed_at_ms; replaying the same inputs with those same values produces the same ApiVisibilityComparison. A caller must allocate a new comparison identity for a genuinely new observation.

Examples

use serde_json::json;
use termivar_core::{
    ApiSurfaceKind, ApiVisibilityDimension, ApiVisibilityPairKind,
    ApiVisibilityResult,
};
use termivar_scanner::ApiVisibilityComparator;

let comparator = ApiVisibilityComparator::default();
let baseline = comparator.capture_view(
    "anonymous-view",
    "resource:account-42",
    ApiSurfaceKind::JsonHttp,
    200,
    &json!({"id": 42}),
)?;
let candidate = comparator.capture_view(
    "member-view",
    "resource:account-42",
    ApiSurfaceKind::JsonHttp,
    200,
    &json!({"id": 42, "email": "redacted@example.test"}),
)?;
let comparison = comparator.compare(
    "comparison-17",
    ApiVisibilityPairKind::AuthorizationContext,
    ApiVisibilityDimension::Fields,
    &baseline,
    &candidate,
    1_800_000_000_000,
)?;

assert_eq!(comparison.result(), ApiVisibilityResult::Different);

Implementations

impl ApiVisibilityComparator

pub fn capture_profiled_view( &self, profile: &ApiComparisonProfile, context_id: impl Into<String>, resource_scope_id: impl Into<String>, surface: ApiSurfaceKind, status: u16, snapshot: &Value, ) -> Result<ProfiledApiVisibilityView, ProfiledApiVisibilityError>

Captures a bounded view under one explicit projection profile.

The legacy canonicalizer first validates the complete snapshot against this comparator’s resource envelope. Projection therefore cannot hide oversized input. The second pass retains only signatures and a bounded digest/type/value index; raw values and clear-text observed paths are discarded before this method returns.

pub fn compare_profiled( &self, profile: &ApiComparisonProfile, comparison_id: impl Into<String>, pair: ApiVisibilityPairKind, dimension: ApiVisibilityDimension, baseline: &ProfiledApiVisibilityView, candidate: &ProfiledApiVisibilityView, observed_at_ms: u64, ) -> Result<ProfiledApiVisibilityComparison, ProfiledApiVisibilityError>

Compares two profiled views and emits a replayable metadata envelope.

Version, policy, and limit mismatches fail closed before a result is emitted. The caller-owned comparison handle is domain-hashed together with the complete metadata tuple before constructing the nested legacy comparison, preventing evidence identity aliases across profiles.

impl ApiVisibilityComparator

pub const fn new(limits: ApiVisibilityLimits) -> Self

Creates a pure comparator under an already validated resource envelope.

pub const fn limits(&self) -> ApiVisibilityLimits

Returns the immutable canonicalization envelope.

pub fn capture_view( &self, context_id: impl Into<String>, resource_scope_id: impl Into<String>, surface: ApiSurfaceKind, status: u16, snapshot: &Value, ) -> Result<ApiVisibilityView, ApiVisibilityEvidenceError>

Captures bounded signatures from one borrowed JSON snapshot.

The snapshot is traversed once and discarded when this call returns. No raw scalar, key, body, token, or canonical byte stream is retained in the returned view, and deterministic signatures are redacted from its std::fmt::Debug representation.

The supplied serde_json::Value has already been read and parsed, so these traversal limits cannot bound transport reads or parser allocation. The host must enforce its response-byte budget before parsing untrusted JSON and must keep raw response values out of logs.

pub fn compare( &self, comparison_id: impl Into<String>, pair: ApiVisibilityPairKind, dimension: ApiVisibilityDimension, baseline: &ApiVisibilityView, candidate: &ApiVisibilityView, observed_at_ms: u64, ) -> Result<ApiVisibilityComparison, ApiVisibilityEvidenceError>

Compares one explicit dimension and emits only the typed core contract.

Views must use this comparator’s limits, the same resource scope and API surface, and distinct context handles. comparison_id is a caller-owned immutable observation identity. It and both handles must be non-secret because the core comparison’s replay form serializes them.

Trait Implementations

impl Clone for ApiVisibilityComparator

fn clone(&self) -> ApiVisibilityComparator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ApiVisibilityComparator

impl Debug for ApiVisibilityComparator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ApiVisibilityComparator

fn default() -> Self

Returns the “default value” for a type.

impl Eq for ApiVisibilityComparator

impl PartialEq for ApiVisibilityComparator

fn eq(&self, other: &ApiVisibilityComparator) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ApiVisibilityComparator