spiral-sdk 0.1.11

// Generated by tools/service-contracts/rust.py. Do not edit.
#![doc = "Generated transport-independent contract objects."]

use std::collections::BTreeMap;
use std::error::Error as StdError;
use std::fmt::{self, Display, Formatter};

use serde::{Deserialize, Deserializer, Serialize, Serializer};
use serde_json::Value;
use spiral_contract::error::{ErrorEnvelope, ServiceError};
use spiral_contract::strict::{DeserializeStrict, Strict};
use uuid::Uuid;

/// An Organization's decision for one third-party client.
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum AppAccessDecision {
    /// A known contract value.
    Allow,
    /// A known contract value.
    Block,
    /// A value introduced by a newer server.
    Unknown(String),
}
impl Serialize for AppAccessDecision {
    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
        serializer.serialize_str(match self {
            Self::Allow => "allow",
            Self::Block => "block",
            Self::Unknown(value) => value,
        })
    }
}
impl<'de> Deserialize<'de> for AppAccessDecision {
    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        Ok(match String::deserialize(deserializer)?.as_str() {
            "allow" => Self::Allow,
            "block" => Self::Block,
            value => Self::Unknown(value.to_owned()),
        })
    }
}
impl<'de> DeserializeStrict<'de> for AppAccessDecision {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        enum __Known {
            #[serde(rename = "allow")]
            Allow,
            #[serde(rename = "block")]
            Block,
        }
        Ok(match __Known::deserialize(deserializer)? {
            __Known::Allow => Self::Allow,
            __Known::Block => Self::Block,
        })
    }
}

/// One client and the Organization's decision for it.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ClientAppAccess {
    /// Contract field clientId.
    #[serde(rename = "clientId")]
    pub client_id: String,
    /// Contract field decision.
    #[serde(rename = "decision")]
    pub decision: AppAccessDecision,
}
impl<'de> DeserializeStrict<'de> for ClientAppAccess {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "clientId")]
            client_id: Strict<String>,
            #[serde(rename = "decision")]
            decision: Strict<AppAccessDecision>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            client_id: wire.client_id.0,
            decision: wire.decision.0,
        })
    }
}

/// One exact HTTPS callback. Its browser CORS origin is derived from the URI.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ClientRedirect {
    /// Contract field redirectUri.
    #[serde(rename = "redirectUri")]
    pub redirect_uri: String,
}
impl<'de> DeserializeStrict<'de> for ClientRedirect {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "redirectUri")]
            redirect_uri: Strict<String>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            redirect_uri: wire.redirect_uri.0,
        })
    }
}

/// A client that signs users in with user consent, or obtains tokens for itself. Sign-in requires
/// exact callbacks, PKCE and user consent. Background tokens name the client as subject and carry
/// no authority of their own: authorization decides what the subject may do. A client can exist
/// before it has a credential. A token_exchange-only Connection registration names the external
/// audiences for identities that its owning registrar requests.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ClientRegistration {
    /// Contract field audience.
    #[serde(rename = "audience")]
    pub audience: Vec<String>,
    /// Contract field clientName.
    #[serde(rename = "clientName")]
    pub client_name: String,
    /// Contract field enabled.
    #[serde(rename = "enabled")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub enabled: Option<bool>,
    /// Contract field grantTypes.
    #[serde(rename = "grantTypes")]
    pub grant_types: Vec<GrantType>,
    /// Contract field jwks.
    #[serde(rename = "jwks")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub jwks: Option<Value>,
    /// Contract field jwtBearerIssuers.
    #[serde(rename = "jwtBearerIssuers")]
    pub jwt_bearer_issuers: Vec<JwtBearerIssuer>,
    /// Contract field signIn.
    #[serde(rename = "signIn")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub sign_in: Option<SignInRegistration>,
}
impl<'de> DeserializeStrict<'de> for ClientRegistration {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "audience")]
            audience: Strict<Vec<String>>,
            #[serde(rename = "clientName")]
            client_name: Strict<String>,
            #[serde(rename = "enabled")]
            #[serde(default)]
            enabled: Strict<Option<bool>>,
            #[serde(rename = "grantTypes")]
            grant_types: Strict<Vec<GrantType>>,
            #[serde(rename = "jwks")]
            #[serde(default)]
            jwks: Strict<Option<Value>>,
            #[serde(rename = "jwtBearerIssuers")]
            jwt_bearer_issuers: Strict<Vec<JwtBearerIssuer>>,
            #[serde(rename = "signIn")]
            #[serde(default)]
            sign_in: Strict<Option<SignInRegistration>>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            audience: wire.audience.0,
            client_name: wire.client_name.0,
            enabled: wire.enabled.0,
            grant_types: wire.grant_types.0,
            jwks: wire.jwks.0,
            jwt_bearer_issuers: wire.jwt_bearer_issuers.0,
            sign_in: wire.sign_in.0,
        })
    }
}

/// The verified OAuth client and callback shown by the consent application.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ConsentClient {
    /// Contract field id.
    #[serde(rename = "id")]
    pub id: String,
    /// Contract field loopbackOnly.
    #[serde(rename = "loopbackOnly")]
    pub loopback_only: bool,
    /// Contract field managed.
    #[serde(rename = "managed")]
    pub managed: bool,
    /// Contract field name.
    #[serde(rename = "name")]
    pub name: String,
    /// Contract field publisher.
    #[serde(rename = "publisher")]
    pub publisher: String,
    /// Contract field publisherName.
    #[serde(rename = "publisherName")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub publisher_name: Option<String>,
    /// Contract field redirectHost.
    #[serde(rename = "redirectHost")]
    pub redirect_host: String,
}
impl<'de> DeserializeStrict<'de> for ConsentClient {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "id")]
            id: Strict<String>,
            #[serde(rename = "loopbackOnly")]
            loopback_only: Strict<bool>,
            #[serde(rename = "managed")]
            managed: Strict<bool>,
            #[serde(rename = "name")]
            name: Strict<String>,
            #[serde(rename = "publisher")]
            publisher: Strict<String>,
            #[serde(rename = "publisherName")]
            #[serde(default)]
            publisher_name: Strict<Option<String>>,
            #[serde(rename = "redirectHost")]
            redirect_host: Strict<String>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            id: wire.id.0,
            loopback_only: wire.loopback_only.0,
            managed: wire.managed.0,
            name: wire.name.0,
            publisher: wire.publisher.0,
            publisher_name: wire.publisher_name.0,
            redirect_host: wire.redirect_host.0,
        })
    }
}

/// Accept only the listed requested scopes, or reject the authorization.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ConsentDecision {
    /// Contract field approve.
    #[serde(rename = "approve")]
    pub approve: bool,
    /// Contract field scopes.
    #[serde(rename = "scopes")]
    pub scopes: Vec<String>,
}
impl<'de> DeserializeStrict<'de> for ConsentDecision {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "approve")]
            approve: Strict<bool>,
            #[serde(rename = "scopes")]
            scopes: Strict<Vec<String>>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            approve: wire.approve.0,
            scopes: wire.scopes.0,
        })
    }
}

/// Return the initiating browser to this authorization-server URL to finish consent.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ConsentRedirect {
    /// Contract field redirectTo.
    #[serde(rename = "redirectTo")]
    pub redirect_to: String,
}
impl<'de> DeserializeStrict<'de> for ConsentRedirect {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "redirectTo")]
            redirect_to: Strict<String>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            redirect_to: wire.redirect_to.0,
        })
    }
}

/// The requested delegation. A challenge contains no access or refresh token.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ConsentRequest {
    /// Contract field client.
    #[serde(rename = "client")]
    pub client: ConsentClient,
    /// Contract field resource.
    #[serde(rename = "resource")]
    pub resource: String,
    /// Contract field scopes.
    #[serde(rename = "scopes")]
    pub scopes: Vec<String>,
    /// Contract field skip.
    #[serde(rename = "skip")]
    pub skip: bool,
    /// Contract field subject.
    #[serde(rename = "subject")]
    pub subject: ConsentSubject,
}
impl<'de> DeserializeStrict<'de> for ConsentRequest {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "client")]
            client: Strict<ConsentClient>,
            #[serde(rename = "resource")]
            resource: Strict<String>,
            #[serde(rename = "scopes")]
            scopes: Strict<Vec<String>>,
            #[serde(rename = "skip")]
            skip: Strict<bool>,
            #[serde(rename = "subject")]
            subject: Strict<ConsentSubject>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            client: wire.client.0,
            resource: wire.resource.0,
            scopes: wire.scopes.0,
            skip: wire.skip.0,
            subject: wire.subject.0,
        })
    }
}

/// The authenticated user and Organization bound to this authorization.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct ConsentSubject {
    /// Contract field organizationId.
    #[serde(rename = "organizationId")]
    pub organization_id: String,
    /// Contract field organizationName.
    #[serde(rename = "organizationName")]
    pub organization_name: String,
    /// Contract field userId.
    #[serde(rename = "userId")]
    pub user_id: String,
}
impl<'de> DeserializeStrict<'de> for ConsentSubject {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "organizationId")]
            organization_id: Strict<String>,
            #[serde(rename = "organizationName")]
            organization_name: Strict<String>,
            #[serde(rename = "userId")]
            user_id: Strict<String>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            organization_id: wire.organization_id.0,
            organization_name: wire.organization_name.0,
            user_id: wire.user_id.0,
        })
    }
}

/// A grant that a client uses at the token endpoint. client_credentials authenticates the client
/// with a private_key_jwt assertion signed by a key in its jwks. jwt_bearer is the RFC 7523 grant
/// for an ID token from one of its jwtBearerIssuers.
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum GrantType {
    /// A known contract value.
    ClientCredentials,
    /// A known contract value.
    JwtBearer,
    /// A known contract value.
    TokenExchange,
    /// A known contract value.
    AuthorizationCode,
    /// A known contract value.
    RefreshToken,
    /// A value introduced by a newer server.
    Unknown(String),
}
impl Serialize for GrantType {
    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
        serializer.serialize_str(match self {
            Self::ClientCredentials => "client_credentials",
            Self::JwtBearer => "jwt_bearer",
            Self::TokenExchange => "token_exchange",
            Self::AuthorizationCode => "authorization_code",
            Self::RefreshToken => "refresh_token",
            Self::Unknown(value) => value,
        })
    }
}
impl<'de> Deserialize<'de> for GrantType {
    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        Ok(match String::deserialize(deserializer)?.as_str() {
            "client_credentials" => Self::ClientCredentials,
            "jwt_bearer" => Self::JwtBearer,
            "token_exchange" => Self::TokenExchange,
            "authorization_code" => Self::AuthorizationCode,
            "refresh_token" => Self::RefreshToken,
            value => Self::Unknown(value.to_owned()),
        })
    }
}
impl<'de> DeserializeStrict<'de> for GrantType {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        enum __Known {
            #[serde(rename = "client_credentials")]
            ClientCredentials,
            #[serde(rename = "jwt_bearer")]
            JwtBearer,
            #[serde(rename = "token_exchange")]
            TokenExchange,
            #[serde(rename = "authorization_code")]
            AuthorizationCode,
            #[serde(rename = "refresh_token")]
            RefreshToken,
        }
        Ok(match __Known::deserialize(deserializer)? {
            __Known::ClientCredentials => Self::ClientCredentials,
            __Known::JwtBearer => Self::JwtBearer,
            __Known::TokenExchange => Self::TokenExchange,
            __Known::AuthorizationCode => Self::AuthorizationCode,
            __Known::RefreshToken => Self::RefreshToken,
        })
    }
}

/// An identity provider whose ID tokens identify the client. A token must carry every listed claim
/// value, and its audience must be the token endpoint unless audience names another. Naming one
/// departs from RFC 7523 section 3, for an issuer whose tokens cannot name the authorization
/// server.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct JwtBearerIssuer {
    /// Contract field audience.
    #[serde(rename = "audience")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audience: Option<String>,
    /// Contract field claims.
    #[serde(rename = "claims")]
    pub claims: BTreeMap<String, String>,
    /// Contract field issuer.
    #[serde(rename = "issuer")]
    pub issuer: String,
}
impl<'de> DeserializeStrict<'de> for JwtBearerIssuer {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "audience")]
            #[serde(default)]
            audience: Strict<Option<String>>,
            #[serde(rename = "claims")]
            claims: Strict<BTreeMap<String, String>>,
            #[serde(rename = "issuer")]
            issuer: Strict<String>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            audience: wire.audience.0,
            claims: wire.claims.0,
            issuer: wire.issuer.0,
        })
    }
}

/// Which third-party clients an Organization's users may sign in to. A client's own decision takes
/// precedence over unlisted.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct OrganizationAppAccess {
    /// Contract field clients.
    #[serde(rename = "clients")]
    pub clients: Vec<ClientAppAccess>,
    /// Contract field unlisted.
    #[serde(rename = "unlisted")]
    pub unlisted: UnlistedAppAccess,
}
impl<'de> DeserializeStrict<'de> for OrganizationAppAccess {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "clients")]
            clients: Strict<Vec<ClientAppAccess>>,
            #[serde(rename = "unlisted")]
            unlisted: Strict<UnlistedAppAccess>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            clients: wire.clients.0,
            unlisted: wire.unlisted.0,
        })
    }
}

/// Whose users a sign-in client is built for. Absent means internal.
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum SignInAudience {
    /// A known contract value.
    Internal,
    /// A known contract value.
    Public,
    /// A value introduced by a newer server.
    Unknown(String),
}
impl Serialize for SignInAudience {
    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
        serializer.serialize_str(match self {
            Self::Internal => "internal",
            Self::Public => "public",
            Self::Unknown(value) => value,
        })
    }
}
impl<'de> Deserialize<'de> for SignInAudience {
    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        Ok(match String::deserialize(deserializer)?.as_str() {
            "internal" => Self::Internal,
            "public" => Self::Public,
            value => Self::Unknown(value.to_owned()),
        })
    }
}
impl<'de> DeserializeStrict<'de> for SignInAudience {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        enum __Known {
            #[serde(rename = "internal")]
            Internal,
            #[serde(rename = "public")]
            Public,
        }
        Ok(match __Known::deserialize(deserializer)? {
            __Known::Internal => Self::Internal,
            __Known::Public => Self::Public,
        })
    }
}

/// A third-party sign-in client, with exact callbacks and a publisher shown at consent.
/// organizationId is required for registrar-managed sign-in and names the developer Organization.
/// An internal audience admits only that Organization's users; a public audience admits other
/// Organizations once Spiral has reviewed the client, subject to each Organization's app access.
/// Existing registrations without an organizationId cannot sign users in. allowedCorsOrigins lists
/// the exact browser origins whose scripts may call the token endpoint as the client, and to which
/// resource servers answer its exchanged tokens.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct SignInRegistration {
    /// Contract field allowedCorsOrigins.
    #[serde(rename = "allowedCorsOrigins")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub allowed_cors_origins: Option<Vec<String>>,
    /// Contract field audience.
    #[serde(rename = "audience")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audience: Option<SignInAudience>,
    /// Contract field organizationId.
    #[serde(rename = "organizationId")]
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub organization_id: Option<String>,
    /// Contract field publisher.
    #[serde(rename = "publisher")]
    pub publisher: String,
    /// Contract field redirectUris.
    #[serde(rename = "redirectUris")]
    pub redirect_uris: Vec<String>,
    /// Contract field resources.
    #[serde(rename = "resources")]
    pub resources: Vec<String>,
    /// Contract field scopes.
    #[serde(rename = "scopes")]
    pub scopes: Vec<String>,
}
impl<'de> DeserializeStrict<'de> for SignInRegistration {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct __Wire {
            #[serde(rename = "allowedCorsOrigins")]
            #[serde(default)]
            allowed_cors_origins: Strict<Option<Vec<String>>>,
            #[serde(rename = "audience")]
            #[serde(default)]
            audience: Strict<Option<SignInAudience>>,
            #[serde(rename = "organizationId")]
            #[serde(default)]
            organization_id: Strict<Option<String>>,
            #[serde(rename = "publisher")]
            publisher: Strict<String>,
            #[serde(rename = "redirectUris")]
            redirect_uris: Strict<Vec<String>>,
            #[serde(rename = "resources")]
            resources: Strict<Vec<String>>,
            #[serde(rename = "scopes")]
            scopes: Strict<Vec<String>>,
        }
        let wire = __Wire::deserialize(deserializer)?;
        Ok(Self {
            allowed_cors_origins: wire.allowed_cors_origins.0,
            audience: wire.audience.0,
            organization_id: wire.organization_id.0,
            publisher: wire.publisher.0,
            redirect_uris: wire.redirect_uris.0,
            resources: wire.resources.0,
            scopes: wire.scopes.0,
        })
    }
}

/// What an Organization does with third-party clients it has not decided on: allow those Spiral
/// reviewed, or block them.
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum UnlistedAppAccess {
    /// A known contract value.
    AllowReviewed,
    /// A known contract value.
    Block,
    /// A value introduced by a newer server.
    Unknown(String),
}
impl Serialize for UnlistedAppAccess {
    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
        serializer.serialize_str(match self {
            Self::AllowReviewed => "allow_reviewed",
            Self::Block => "block",
            Self::Unknown(value) => value,
        })
    }
}
impl<'de> Deserialize<'de> for UnlistedAppAccess {
    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        Ok(match String::deserialize(deserializer)?.as_str() {
            "allow_reviewed" => Self::AllowReviewed,
            "block" => Self::Block,
            value => Self::Unknown(value.to_owned()),
        })
    }
}
impl<'de> DeserializeStrict<'de> for UnlistedAppAccess {
    fn deserialize_strict<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        #[derive(Deserialize)]
        enum __Known {
            #[serde(rename = "allow_reviewed")]
            AllowReviewed,
            #[serde(rename = "block")]
            Block,
        }
        Ok(match __Known::deserialize(deserializer)? {
            __Known::AllowReviewed => Self::AllowReviewed,
            __Known::Block => Self::Block,
        })
    }
}

/// Typed errors declared by this service contract.
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum AuthnError {
    /// Authn:ClientConflict.
    ClientConflict { client_id: String },
    /// Authn:ClientNotFound.
    ClientNotFound { client_id: String },
    /// Authn:ConsentConflict.
    ConsentConflict { reason: String },
    /// Authn:InvalidClient.
    InvalidClient { reason: String },
    /// Authn:InvalidConsent.
    InvalidConsent { reason: String },
}
impl AuthnError {
    /// HTTP status for this declared error.
    pub fn status(&self) -> u16 {
        match self {
            Self::ClientConflict { .. } => 409,
            Self::ClientNotFound { .. } => 404,
            Self::ConsentConflict { .. } => 409,
            Self::InvalidClient { .. } => 400,
            Self::InvalidConsent { .. } => 400,
        }
    }
    /// Serialize only contract-declared error parameters.
    pub fn envelope(&self, instance: String) -> ErrorEnvelope {
        match self {
            Self::ClientConflict { client_id } => {
                let mut envelope = ErrorEnvelope::new("CONFLICT", "Authn:ClientConflict", instance);
                envelope
                    .parameters
                    .insert("clientId".into(), client_id.to_string());
                envelope
            }
            Self::ClientNotFound { client_id } => {
                let mut envelope =
                    ErrorEnvelope::new("NOT_FOUND", "Authn:ClientNotFound", instance);
                envelope
                    .parameters
                    .insert("clientId".into(), client_id.to_string());
                envelope
            }
            Self::ConsentConflict { reason } => {
                let mut envelope =
                    ErrorEnvelope::new("CONFLICT", "Authn:ConsentConflict", instance);
                envelope
                    .parameters
                    .insert("reason".into(), reason.to_string());
                envelope
            }
            Self::InvalidClient { reason } => {
                let mut envelope =
                    ErrorEnvelope::new("INVALID_ARGUMENT", "Authn:InvalidClient", instance);
                envelope
                    .parameters
                    .insert("reason".into(), reason.to_string());
                envelope
            }
            Self::InvalidConsent { reason } => {
                let mut envelope =
                    ErrorEnvelope::new("INVALID_ARGUMENT", "Authn:InvalidConsent", instance);
                envelope
                    .parameters
                    .insert("reason".into(), reason.to_string());
                envelope
            }
        }
    }
    /// Decode a declared error and its typed error parameters.
    pub fn decode_envelope(envelope: &ErrorEnvelope) -> Option<Self> {
        if envelope.error_instance_id.len() != 36
            || Uuid::parse_str(&envelope.error_instance_id).is_err()
        {
            return None;
        }
        match envelope.error_name.as_str() {
            "Authn:ClientConflict" => {
                if envelope.error_code != "CONFLICT" {
                    return None;
                }
                let client_id = envelope.parameters.get("clientId")?.clone();
                Some(Self::ClientConflict { client_id })
            }
            "Authn:ClientNotFound" => {
                if envelope.error_code != "NOT_FOUND" {
                    return None;
                }
                let client_id = envelope.parameters.get("clientId")?.clone();
                Some(Self::ClientNotFound { client_id })
            }
            "Authn:ConsentConflict" => {
                if envelope.error_code != "CONFLICT" {
                    return None;
                }
                let reason = envelope.parameters.get("reason")?.clone();
                Some(Self::ConsentConflict { reason })
            }
            "Authn:InvalidClient" => {
                if envelope.error_code != "INVALID_ARGUMENT" {
                    return None;
                }
                let reason = envelope.parameters.get("reason")?.clone();
                Some(Self::InvalidClient { reason })
            }
            "Authn:InvalidConsent" => {
                if envelope.error_code != "INVALID_ARGUMENT" {
                    return None;
                }
                let reason = envelope.parameters.get("reason")?.clone();
                Some(Self::InvalidConsent { reason })
            }
            _ => None,
        }
    }
}
impl Display for AuthnError {
    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
        match self {
            Self::ClientConflict { client_id } => {
                write!(formatter, "Authn:ClientConflict (clientId: {})", client_id)
            }
            Self::ClientNotFound { client_id } => {
                write!(formatter, "Authn:ClientNotFound (clientId: {})", client_id)
            }
            Self::ConsentConflict { reason } => {
                write!(formatter, "Authn:ConsentConflict (reason: {})", reason)
            }
            Self::InvalidClient { reason } => {
                write!(formatter, "Authn:InvalidClient (reason: {})", reason)
            }
            Self::InvalidConsent { reason } => {
                write!(formatter, "Authn:InvalidConsent (reason: {})", reason)
            }
        }
    }
}
impl StdError for AuthnError {}
impl ServiceError for AuthnError {
    fn to_envelope(&self, instance: String) -> ErrorEnvelope {
        Self::envelope(self, instance)
    }
    fn from_envelope(envelope: &ErrorEnvelope) -> Option<Self> {
        Self::decode_envelope(envelope)
    }
}