Enum VerifyError 

pub enum VerifyError {
    MissingCredential,
    Malformed(String),
    BadAlg(String),
    UntrustedIssuer(String),
    UnknownKid(String),
    BadAttestation(String),
    AttestationExpired,
    DeviceNotActive,
    BadJwk(String),
    KeyNotBound,
    BadSignature(String),
    SignatureExpired,
    LifetimeTooLong,
    MethodMismatch,
    PathMismatch,
    AudienceMismatch,
    QueryMismatch,
    BodyMismatch,
    ReplayDetected,
    BodyTooLarge(usize),
}

Why crate::verify rejected a request. Never carries the raw cryptographic material that caused the rejection — only enough to log or monitor safely.

Variants

MissingCredential

X-Signature and/or X-Attestation absent.

Malformed(String)

One of the two headers is not a syntactically valid compact JWS.

BadAlg(String)

alg is not in the configured allow-list, is none, or is a symmetric algorithm (HS256/384/512) — rejected unconditionally regardless of configuration, because this scheme is asymmetric-only by construction (the private key never leaves the device).

UntrustedIssuer(String)

The attestation’s iss is not one of the configured trusted issuers.

UnknownKid(String)

The attestation’s kid is not present in the cached Issuer JWKS.

BadAttestation(String)

The attestation’s signature does not verify against the resolved Issuer key.

AttestationExpired

now falls outside [att.iat - skew, att.exp + skew].

DeviceNotActive

The attestation’s att.status is not "active".

BadJwk(String)

The embedded jwk (from the request signature’s protected header) is missing, is not a public key of an allowed type, or carries a private component (d, p, q, dp, dq, qi, k).

KeyNotBound

The security-critical rejection. thumbprint(sig.header.jwk) != att.claims.cnf.jkt.

An attacker who presents a victim’s valid attestation (it is public — it travels in every request) alongside a request signed with the attacker’s own key lands here. The attestation’s signature verifies fine (it’s genuinely from the Issuer) and the request signature verifies fine (against the attacker’s own, genuinely-held key) — only this thumbprint comparison detects that the two credentials do not describe the same key. Skipping, reordering, or short-circuiting this check is a total authentication bypass.

BadSignature(String)

The request signature does not verify against the embedded jwk.

SignatureExpired

now falls outside [sig.iat - skew, sig.exp + skew].

LifetimeTooLong

sig.exp - sig.iat exceeds the configured maximum signature lifetime.

MethodMismatch

sig.mth != request.method.

PathMismatch

sig.pth != request.path.

AudienceMismatch

sig.aud != expected_audience.

QueryMismatch

A query string is present on the live request but sig.qsh disagrees (or is absent).

BodyMismatch

A body is present on the live request but sig.bdh disagrees (or is absent).

ReplayDetected

jti was already seen, or the replay store was unreachable. These reject identically — an unreachable replay store must never be treated as “no replay recorded, so allow”.

BodyTooLarge(usize)

The request body exceeded the configured maximum size before it could be hashed. Only produced by the optional framework-integration layer/middleware (in authkestra-axum or authkestra-actix), which must buffer the body to compute bdh — never by crate::verify itself, which takes body bytes the caller already has.

Implementations

impl VerifyError

pub fn code(&self) -> &'static str

The machine-readable rejection code (e.g. "key_not_bound"), stable across changes to the Display message wording. Suitable for metrics labels and log fields.

Trait Implementations

impl Clone for VerifyError

fn clone(&self) -> VerifyError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VerifyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for VerifyError

impl Error for VerifyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for VerifyError

fn eq(&self, other: &VerifyError) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for VerifyError