Enum AuthZenEvaluationError 

#[non_exhaustive]
pub enum AuthZenEvaluationError {
    Refused(AuthZenError),
    UnreadableProfile {
        received: String,
        understood: &'static str,
    },
    UnusableResponse {
        detail: String,
    },
    Unresolved {
        pointer: String,
        reason: String,
    },
    UnusableRequest {
        detail: String,
    },
    Transport(AxonFlowError),
}

Everything that can come back instead of a decision.

The variants are separated by what a caller should DO, not by where the failure happened:

• Self::Refused - fix the request; the refusal names the member.
• Self::Unresolved - re-resolve an attribute and build a NEW request.
• Self::UnreadableProfile - upgrade the SDK.
• Self::UnusableResponse - a server contract violation to report.
• Self::UnusableRequest - the envelope could not be encoded; a backstop.
• Self::Transport - no answer; may simply be retried.

Collapsing them into one opaque error would leave a caller with a string to match on.

#[non_exhaustive] because this enum has no catch-all variant and is a public surface committed through v11. Without the attribute, every downstream match over the six variants is exhaustive, and the first outcome this surface learns to distinguish would break all of them. With it, a caller writes a _ arm once and a seventh variant is a minor release.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Refused(AuthZenError)

The request was refused rather than evaluated - by the server, or by this client before the round trip.

Both name the SAME MEMBER: a local refusal carries the JSON Pointer the server would have sent for the same bytes, verified against a live server by runtime-e2e/authzen_evaluation.

The CODE may be narrower on the server side, and that is not a defect in either. This client knows only that a required member is missing, and says incomplete_evaluation; the server additionally knows which values it can evaluate, and narrows the same condition to unsupported_subject with a supported list. Branch on the pointer for “which member”, and treat the code as the server’s more specific reading when there is one.

UnreadableProfile

The server answered in a profile this build cannot interpret.

NOT retryable, and not folded into Self::Refused for exactly that reason: evaluation_unavailable is the enumeration’s retryable code, and reporting “upgrade the SDK” through it would send a client into a retry loop against a server that will answer identically every time.

Fields

received: String

What the server said it was speaking.

understood: &'static str

What this build can read.

UnusableResponse

The server answered 200 with a body this build will not act on.

A decision that cannot be read completely is not a decision. Acting on the half that parsed is how an allow carrying a mandatory obligation reaches an enforcement point that never saw it.

Fields

detail: String

What about the body could not be trusted.

Unresolved

The request could not be SENT as built: it carries an attribute the caller could not resolve.

Separate from Self::Refused, and NOT retryable, because the two need opposite actions from the caller. A server evaluation_unavailable says “send these bytes again”; this says “re-resolve the attribute and build a NEW request”. Reporting it as retryable - which an earlier version of this SDK did - sends a while err.retryable() loop against a request whose refusal is frozen inside it, so every attempt produces the identical error until the budget runs out.

The OPERATION may well succeed once the attribute resolves. That is a statement about a different request, and it is why this carries the pointer and the reason rather than a boolean.

Fields

pointer: String

The JSON Pointer naming the member nobody could resolve.

reason: String

The refusal message, which carries the reason the caller gave.

UnusableRequest

The envelope could not be encoded.

A backstop, not an ordinary outcome: the only way to reach it is to bypass validation and hand the encoder an unresolved attribute. It is distinct from Self::UnusableResponse because that one names a SERVER contract violation to report, and an operator handed one label for both cannot tell “the platform is emitting a body I must file a bug about” from “my own request was not built correctly”.

Fields

detail: String

What about the envelope could not be encoded.

Transport(AxonFlowError)

The request never got an answer: connection, timeout, credentials, or a non-refusal error status.

This surface does NOT apply the client’s crate::RetryConfig: that executor is wired to the proxy path’s request type, and retrying an authorization decision on the caller’s behalf is a policy decision this SDK does not make for them. Retry is the caller’s, guided by AuthZenEvaluationError::retryable.

Implementations

impl AuthZenEvaluationError

pub fn retryable(&self) -> bool

Whether sending the same request again could produce a different answer.

This is the whole retryable set, in one place, so a caller never has to assemble it from status codes:

• a refusal - only when its code is evaluation_unavailable;
• a transport failure - timeout, connect, 5xx, 429;
• an unreadable profile - never;
• an unusable response - never;
• an unresolved attribute - NEVER, because the refusal is frozen inside the request. The OPERATION may succeed once the attribute resolves, but that is a different request, and this method answers only about this one.
• an unencodable request - never.

pub fn as_refusal(&self) -> Option<&AuthZenError>

The typed refusal, when there is one.

Trait Implementations

impl Debug for AuthZenEvaluationError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AuthZenEvaluationError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for AuthZenEvaluationError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<AuthZenError> for AuthZenEvaluationError

fn from(source: AuthZenError) -> Self

Converts to this type from the input type.

impl From<AxonFlowError> for AuthZenEvaluationError

fn from(source: AxonFlowError) -> Self

Converts to this type from the input type.