Badge API¶

from capiscio_sdk import verify_badge, parse_badge, TrustLevel

# Verify a badge from another agent
result = verify_badge(
    token,
    trusted_issuers=["https://registry.capisc.io"],
    audience="https://my-service.example.com",
)

if result.valid:
    print(f"✅ Agent {result.claims.subject} verified")  # Agent DID
    print(f"   Trust Level: {result.claims.trust_level.value}")  # "0" to "4"
    print(f"   Domain: {result.claims.domain}")
    print(f"   IAL: {result.claims.ial}")  # Identity Assurance Level
else:
    print(f"❌ Verification failed: {result.error}")

from capiscio_sdk import verify_badge
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.middleware("http")
async def verify_badge_middleware(request: Request, call_next):
    # Skip for health checks
    if request.url.path == "/health":
        return await call_next(request)

    # Get badge from Authorization header
    auth = request.headers.get("Authorization", "")
    if not auth.startswith("Bearer "):
        raise HTTPException(401, "Missing badge")

    token = auth[7:]
    result = verify_badge(
        token,
        trusted_issuers=["https://registry.capisc.io"],
        audience=str(request.base_url),
    )

    if not result.valid:
        raise HTTPException(401, f"Invalid badge: {result.error}")

    # Attach claims to request state (matches SDK middleware pattern)
    request.state.agent = result.claims
    request.state.agent_id = result.claims.issuer
    return await call_next(request)

from capiscio_sdk import verify_badge, TrustLevel

def require_trust_level(token: str, min_level: TrustLevel) -> bool:
    """Require minimum trust level for sensitive operations.

    RFC-002 §5 Trust Levels:
    - LEVEL_0: Self-Signed (SS) - development only
    - LEVEL_1: Registered (REG) - account registration
    - LEVEL_2: Domain Validated (DV) - DNS/HTTP proof
    - LEVEL_3: Organization Validated (OV) - legal entity
    - LEVEL_4: Extended Validated (EV) - security audit
    """
    result = verify_badge(token)

    if not result.valid:
        return False

    # TrustLevel enum values are strings "0"-"4", compare as integers
    return int(result.claims.trust_level.value) >= int(min_level.value)

# Usage
if require_trust_level(token, TrustLevel.LEVEL_2):
    # Allow sensitive operation (DV or higher)
    pass