Enum CapabilityFloorVerifyError 

pub enum CapabilityFloorVerifyError {
    RejectedByCryptoFloor {
        floor: CapabilityCryptoFloor,
        signature_algorithm: SigningAlgorithm,
    },
    AlgorithmMismatch {
        declared: SigningAlgorithm,
        actual: SigningAlgorithm,
    },
    Crypto(Error),
}

Errors raised by [CapabilityToken::verify_signature_with_floor].

Distinguishes floor-policy rejections from cryptographic verification failures so the kernel can surface a different audit-log row for each. Threat model row pq_signature_downgrade is the surface this guards.

Variants

RejectedByCryptoFloor

The signature algorithm violates the configured crypto_floor. Fail-closed at the floor boundary BEFORE cryptographic verification runs. Threat model row pq_signature_downgrade is the surface this guards.

Fields

floor: CapabilityCryptoFloor

The configured floor that rejected the token.

signature_algorithm: SigningAlgorithm

The signature algorithm carried by the token.

AlgorithmMismatch

The optional CapabilityToken::algorithm envelope field disagrees with the algorithm carried by Signature. Treated as a downgrade signal and rejected fail-closed.

Fields

declared: SigningAlgorithm

The algorithm declared in the envelope field.

actual: SigningAlgorithm

The algorithm carried by the signature material.

Crypto(Error)

Forwarded from the underlying canonical-JSON or signature verification path.

Trait Implementations

impl Debug for CapabilityFloorVerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Display for CapabilityFloorVerifyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Error for CapabilityFloorVerifyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.