ppoppo-sdk-core 0.2.0

//! [`VerifyError`] — exactly two HTTP dispositions at the perimeter.

/// Verification failure surface — exactly two HTTP dispositions.
///
/// Richer per-substrate taxonomies (chat-auth's break-glass dashboard
/// distinguishes `JtiReplayed` / `SessionVersionStale` / etc.) stay
/// inside the consumer's [`super::AuthProvider`] impl and collapse to
/// one of these two variants at the SDK boundary. The Layer reads only
/// the disposition; the operator dashboard reads the substrate.
#[derive(Debug, Clone, thiserror::Error)]
pub enum VerifyError {
    /// Token rejected — invalid signature, expired, sub missing,
    /// session row missing or revoked, sv mismatch. Maps to **401 +
    /// add-based cookie clearance** at the perimeter so the browser
    /// stops replaying a dead session.
    #[error("token rejected: {0}")]
    Rejected(String),
    /// Substrate transient — JWKS fetch failed with no usable cache,
    /// session-row DB unreachable, sv-axis cache substrate down. Maps
    /// to **503 with cookies preserved**; the session may still be
    /// valid and the browser may retry.
    #[error("auth substrate transient: {0}")]
    SubstrateTransient(String),
}