code: func validateStructure(ctx context.Context, request *discovery.SignedRequest, tlsEnabled bool, certHashFromContext certHashExtractor) (*discovery.Request, error) {
  	if request == nil {
  		return nil, errors.New("nil request")
  	}
  	req, err := request.ToRequest()
  	if err != nil {
  		return nil, errors.Wrap(err, "failed parsing request")
  	}
  	if req.Authentication == nil {
  		return nil, errors.New("access denied, no authentication info in request")
  	}
  	if len(req.Authentication.ClientIdentity) == 0 {
  		return nil, errors.New("access denied, client identity wasn't supplied")
  	}
  	if !tlsEnabled {
  		return req, nil
  	}
  	computedHash := certHashFromContext(ctx)
  	if len(computedHash) == 0 {
  		return nil, errors.New("client didn't send a TLS certificate")
  	}
  	if !bytes.Equal(computedHash, req.Authentication.ClientTlsCertHash) {
  		claimed := hex.EncodeToString(req.Authentication.ClientTlsCertHash)
  		logger.Warningf("client claimed TLS hash %s doesn't match computed TLS hash from gRPC stream %s", claimed, hex.EncodeToString(computedHash))
  		return nil, errors.New("client claimed TLS hash doesn't match computed TLS hash from gRPC stream")
  	}
  	return req, nil
  }
docs: // validateStructure validates that the request contains all the needed fields and that they are computed correctly