# `Attesto.Federation.TrustChain`
[🔗](https://github.com/XukuLLC/attesto/blob/v2.1.0/lib/attesto/federation/trust_chain.ex#L1)

Validate an already-resolved OpenID Federation 1.0 Trust Chain.

The input is ordered leaf first: the leaf Entity Configuration followed by
Subordinate Statements issued successively toward the Trust Anchor. The
final statement is verified with the Trust Anchor keys supplied out of band.
Fetching Entity Statements and choosing among candidate chains remain host
responsibilities.

# `result`

```elixir
@type result() :: %{metadata: map(), trust_anchor: String.t(), exp: non_neg_integer()}
```

# `validation_error`

```elixir
@type validation_error() ::
  Attesto.Federation.EntityStatement.verify_error()
  | :invalid_trust_chain
  | :broken_trust_chain
  | :constraint_violation
  | :policy_error
```

# `validate`

```elixir
@spec validate([String.t()], map() | [map()], keyword()) ::
  {:ok, result()} | {:error, validation_error()}
```

Validate signatures, statement links, time bounds, constraints, and policy.

`:now`, `:leeway`, and `:accepted_algs` are passed to Entity Statement
verification. `:trust_anchor` optionally pins the expected Trust Anchor
Entity Identifier in addition to the out-of-band key pin.

---

*Consult [api-reference.md](api-reference.md) for complete listing*