1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
use thiserror::Error;
/// Error produced while resolving, evaluating, tracing, or auditing a decision.
#[derive(Debug, Error)]
pub enum AuthorizationError<Resolve, Audit> {
/// The request context failed tenant-binding validation before facts were
/// resolved.
#[error(transparent)]
Context(#[from] crate::ContextError),
/// Policy hashing failed before the decision could be anchored.
#[error("failed to hash policy")]
PolicyHash(#[source] postcard::Error),
/// Fact resolution failed before evaluation.
#[error(transparent)]
Resolve(#[from] crate::ResolveError<Resolve>),
/// Resolved fact-set evidence could not be serialized.
#[error(transparent)]
FactResolutionEvidence(#[from] crate::FactResolutionEvidenceError),
/// The current audit entry failed its tenant-binding invariants.
#[error(transparent)]
AuditEntry(#[from] crate::AuditEntryError),
/// Trace serialization failed after evaluation.
#[error(transparent)]
Trace(#[from] crate::TraceError),
/// The captured decision occurrence could not cross the Dovecote time
/// boundary without changing its meaning.
#[error(transparent)]
Occurrence(#[from] crate::DecisionAuditOccurrenceError),
/// Audit recording failed.
#[error("audit sink failed")]
Audit {
/// Reusable identity and occurrence time for an ambiguous retry.
occurrence: crate::DecisionAuditOccurrence,
/// Sink-specific failure.
#[source]
source: Audit,
},
}
impl<Resolve, Audit> AuthorizationError<Resolve, Audit> {
/// Returns the occurrence that was used when audit persistence failed.
#[must_use]
pub const fn audit_occurrence(&self) -> Option<&crate::DecisionAuditOccurrence> {
match self {
Self::Audit { occurrence, .. } => Some(occurrence),
Self::Context(_)
| Self::PolicyHash(_)
| Self::Resolve(_)
| Self::FactResolutionEvidence(_)
| Self::AuditEntry(_)
| Self::Trace(_)
| Self::Occurrence(_) => None,
}
}
}