//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `auth/step-up/approver/enroll`. Version: `0.1`.
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
/// Error from a `TryFrom` or `FromStr` implementation.
pub struct ConversionError(::std::borrow::Cow<'static, str>);
impl ::std::error::Error for ConversionError {}
impl ::std::fmt::Display for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Display::fmt(&self.0, f)
}
}
impl ::std::fmt::Debug for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Debug::fmt(&self.0, f)
}
}
impl From<&'static str> for ConversionError {
fn from(value: &'static str) -> Self {
Self(value.into())
}
}
impl From<String> for ConversionError {
fn from(value: String) -> Self {
Self(value.into())
}
}
}
///One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Approver",
/// "description": "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.",
/// "type": "object",
/// "required": [
/// "approverDid",
/// "enrolledAt",
/// "enrolledVia",
/// "subject"
/// ],
/// "properties": {
/// "approverDid": {
/// "$ref": "#/definitions/ApproverDid"
/// },
/// "enrolledAt": {
/// "description": "When the binding was written.",
/// "type": "string",
/// "format": "date-time"
/// },
/// "enrolledVia": {
/// "$ref": "#/definitions/EnrolledVia"
/// },
/// "label": {
/// "$ref": "#/definitions/ApproverLabel"
/// },
/// "lastUsedAt": {
/// "description": "When a statement by this approver last satisfied a step-up. Absent when it never has.",
/// "type": "string",
/// "format": "date-time"
/// },
/// "subject": {
/// "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 5,
/// "pattern": "^did:"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Approver {
#[serde(rename = "approverDid")]
pub approver_did: ApproverDid,
///When the binding was written.
#[serde(rename = "enrolledAt")]
pub enrolled_at: ::chrono::DateTime<::chrono::offset::Utc>,
#[serde(rename = "enrolledVia")]
pub enrolled_via: EnrolledVia,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub label: ::std::option::Option<ApproverLabel>,
///When a statement by this approver last satisfied a step-up. Absent when it never has.
#[serde(
rename = "lastUsedAt",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub last_used_at: ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
///The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.
pub subject: ApproverSubject,
}
impl Approver {
pub fn builder() -> builder::Approver {
Default::default()
}
}
///A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ApproverDid",
/// "description": "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 16,
/// "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ApproverDid(::std::string::String);
impl ::std::ops::Deref for ApproverDid {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ApproverDid> for ::std::string::String {
fn from(value: ApproverDid) -> Self {
value.0
}
}
impl ::std::str::FromStr for ApproverDid {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
if value.chars().count() < 16usize {
return Err("shorter than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ApproverDid {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ApproverDid {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ApproverDid {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ApproverDid {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ApproverLabel",
/// "description": "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.",
/// "type": "string",
/// "maxLength": 64,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ApproverLabel(::std::string::String);
impl ::std::ops::Deref for ApproverLabel {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ApproverLabel> for ::std::string::String {
fn from(value: ApproverLabel) -> Self {
value.0
}
}
impl ::std::str::FromStr for ApproverLabel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ApproverLabel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ApproverLabel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ApproverLabel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ApproverLabel {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 5,
/// "pattern": "^did:"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ApproverSubject(::std::string::String);
impl ::std::ops::Deref for ApproverSubject {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ApproverSubject> for ::std::string::String {
fn from(value: ApproverSubject) -> Self {
value.0
}
}
impl ::std::str::FromStr for ApproverSubject {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
if value.chars().count() < 5usize {
return Err("shorter than 5 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^did:").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ApproverSubject {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ApproverSubject {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ApproverSubject {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ApproverSubject {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A complete, signed auth/step-up/approver/attest/0.1 Trust Task document — envelope, payload and proof — issued by the approver. Deliberately an open object here rather than a typed one: the consumer verifies it as a document in its own right (envelope, proof and payload against that specification's schemas), and verifies its proof over the members exactly as received, which a binding that narrowed it to a typed struct and re-serialised it could silently break.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AttestStatement",
/// "description": "A complete, signed auth/step-up/approver/attest/0.1 Trust Task document — envelope, payload and proof — issued by the approver. Deliberately an open object here rather than a typed one: the consumer verifies it as a document in its own right (envelope, proof and payload against that specification's schemas), and verifies its proof over the members exactly as received, which a binding that narrowed it to a typed struct and re-serialised it could silently break.",
/// "type": "object",
/// "minProperties": 1
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct AttestStatement(pub ::serde_json::Map<::std::string::String, ::serde_json::Value>);
impl ::std::ops::Deref for AttestStatement {
type Target = ::serde_json::Map<::std::string::String, ::serde_json::Value>;
fn deref(&self) -> &::serde_json::Map<::std::string::String, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<AttestStatement>
for ::serde_json::Map<::std::string::String, ::serde_json::Value>
{
fn from(value: AttestStatement) -> Self {
value.0
}
}
impl ::std::convert::From<::serde_json::Map<::std::string::String, ::serde_json::Value>>
for AttestStatement
{
fn from(value: ::serde_json::Map<::std::string::String, ::serde_json::Value>) -> Self {
Self(value)
}
}
///The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "EnrolledVia",
/// "description": "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.",
/// "type": "string",
/// "enum": [
/// "install",
/// "invite",
/// "selfService",
/// "offline"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum EnrolledVia {
#[serde(rename = "install")]
Install,
#[serde(rename = "invite")]
Invite,
#[serde(rename = "selfService")]
SelfService,
#[serde(rename = "offline")]
Offline,
}
impl ::std::fmt::Display for EnrolledVia {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Install => f.write_str("install"),
Self::Invite => f.write_str("invite"),
Self::SelfService => f.write_str("selfService"),
Self::Offline => f.write_str("offline"),
}
}
}
impl ::std::str::FromStr for EnrolledVia {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"install" => Ok(Self::Install),
"invite" => Ok(Self::Invite),
"selfService" => Ok(Self::SelfService),
"offline" => Ok(Self::Offline),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for EnrolledVia {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for EnrolledVia {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for EnrolledVia {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Ext",
/// "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
/// "type": "object",
/// "minProperties": 1,
/// "additionalProperties": true,
/// "propertyNames": {
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
/// }
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
fn from(value: Ext) -> Self {
value.0
}
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
Self(value)
}
}
///`ExtKey`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
fn from(value: ExtKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExtKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A subject who already holds a step-up factor adds a step-up approver, optionally replacing one of theirs in the same step. The enrolment terms are this payload with `statement` removed; the new approver's statement binds a digest of them. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "$id": "https://trusttasks.org/spec/auth/step-up/approver/enroll/0.1",
/// "title": "Payload",
/// "description": "A subject who already holds a step-up factor adds a step-up approver, optionally replacing one of theirs in the same step. The enrolment terms are this payload with `statement` removed; the new approver's statement binds a digest of them. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
/// "type": "object",
/// "required": [
/// "approverDid"
/// ],
/// "properties": {
/// "approverDid": {
/// "description": "The step-up approver to bind. MUST equal the statement's issuer.",
/// "$ref": "#/definitions/ApproverDid"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "label": {
/// "$ref": "#/definitions/ApproverLabel"
/// },
/// "replaces": {
/// "description": "A live approver of the same subject to revoke in the same step. Part of the enrolment terms, so the authority evidence for adding an approver cannot be reused to remove one.",
/// "$ref": "#/definitions/ApproverDid"
/// },
/// "statement": {
/// "description": "The new approver's complete, signed auth/step-up/approver/attest/0.1 document with `purpose: enrol`, over the challenge of the step-up authorizing this enrolment, with `boundTo` the terms digest defined by this specification. Not part of the enrolment terms. Absent only on a send made to obtain that challenge; an enrolment executes only with it.",
/// "$ref": "#/definitions/AttestStatement"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
///The step-up approver to bind. MUST equal the statement's issuer.
#[serde(rename = "approverDid")]
pub approver_did: ApproverDid,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub label: ::std::option::Option<ApproverLabel>,
///A live approver of the same subject to revoke in the same step. Part of the enrolment terms, so the authority evidence for adding an approver cannot be reused to remove one.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub replaces: ::std::option::Option<ApproverDid>,
///The new approver's complete, signed auth/step-up/approver/attest/0.1 document with `purpose: enrol`, over the challenge of the step-up authorizing this enrolment, with `boundTo` the terms digest defined by this specification. Not part of the enrolment terms. Absent only on a send made to obtain that challenge; an enrolment executes only with it.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub statement: ::std::option::Option<AttestStatement>,
}
impl Payload {
pub fn builder() -> builder::Payload {
Default::default()
}
}
///The new binding as stored.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Response",
/// "description": "The new binding as stored.",
/// "type": "object",
/// "required": [
/// "approver"
/// ],
/// "properties": {
/// "approver": {
/// "$ref": "#/definitions/Approver"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// }
/// },
/// "additionalProperties": false,
/// "$anchor": "response"
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
pub approver: Approver,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
}
impl Response {
pub fn builder() -> builder::Response {
Default::default()
}
}
/// Types for composing complex structures.
pub mod builder {
#[derive(Clone, Debug)]
pub struct Approver {
approver_did: ::std::result::Result<super::ApproverDid, ::std::string::String>,
enrolled_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
enrolled_via: ::std::result::Result<super::EnrolledVia, ::std::string::String>,
label: ::std::result::Result<
::std::option::Option<super::ApproverLabel>,
::std::string::String,
>,
last_used_at: ::std::result::Result<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
::std::string::String,
>,
subject: ::std::result::Result<super::ApproverSubject, ::std::string::String>,
}
impl ::std::default::Default for Approver {
fn default() -> Self {
Self {
approver_did: Err("no value supplied for approver_did".to_string()),
enrolled_at: Err("no value supplied for enrolled_at".to_string()),
enrolled_via: Err("no value supplied for enrolled_via".to_string()),
label: Ok(Default::default()),
last_used_at: Ok(Default::default()),
subject: Err("no value supplied for subject".to_string()),
}
}
}
impl Approver {
pub fn approver_did<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ApproverDid>,
T::Error: ::std::fmt::Display,
{
self.approver_did = value
.try_into()
.map_err(|e| format!("error converting supplied value for approver_did: {e}"));
self
}
pub fn enrolled_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.enrolled_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for enrolled_at: {e}"));
self
}
pub fn enrolled_via<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::EnrolledVia>,
T::Error: ::std::fmt::Display,
{
self.enrolled_via = value
.try_into()
.map_err(|e| format!("error converting supplied value for enrolled_via: {e}"));
self
}
pub fn label<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::ApproverLabel>>,
T::Error: ::std::fmt::Display,
{
self.label = value
.try_into()
.map_err(|e| format!("error converting supplied value for label: {e}"));
self
}
pub fn last_used_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
>,
T::Error: ::std::fmt::Display,
{
self.last_used_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for last_used_at: {e}"));
self
}
pub fn subject<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ApproverSubject>,
T::Error: ::std::fmt::Display,
{
self.subject = value
.try_into()
.map_err(|e| format!("error converting supplied value for subject: {e}"));
self
}
}
impl ::std::convert::TryFrom<Approver> for super::Approver {
type Error = super::error::ConversionError;
fn try_from(value: Approver) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
approver_did: value.approver_did?,
enrolled_at: value.enrolled_at?,
enrolled_via: value.enrolled_via?,
label: value.label?,
last_used_at: value.last_used_at?,
subject: value.subject?,
})
}
}
impl ::std::convert::From<super::Approver> for Approver {
fn from(value: super::Approver) -> Self {
Self {
approver_did: Ok(value.approver_did),
enrolled_at: Ok(value.enrolled_at),
enrolled_via: Ok(value.enrolled_via),
label: Ok(value.label),
last_used_at: Ok(value.last_used_at),
subject: Ok(value.subject),
}
}
}
#[derive(Clone, Debug)]
pub struct Payload {
approver_did: ::std::result::Result<super::ApproverDid, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
label: ::std::result::Result<
::std::option::Option<super::ApproverLabel>,
::std::string::String,
>,
replaces:
::std::result::Result<::std::option::Option<super::ApproverDid>, ::std::string::String>,
statement: ::std::result::Result<
::std::option::Option<super::AttestStatement>,
::std::string::String,
>,
}
impl ::std::default::Default for Payload {
fn default() -> Self {
Self {
approver_did: Err("no value supplied for approver_did".to_string()),
ext: Ok(Default::default()),
label: Ok(Default::default()),
replaces: Ok(Default::default()),
statement: Ok(Default::default()),
}
}
}
impl Payload {
pub fn approver_did<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ApproverDid>,
T::Error: ::std::fmt::Display,
{
self.approver_did = value
.try_into()
.map_err(|e| format!("error converting supplied value for approver_did: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn label<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::ApproverLabel>>,
T::Error: ::std::fmt::Display,
{
self.label = value
.try_into()
.map_err(|e| format!("error converting supplied value for label: {e}"));
self
}
pub fn replaces<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::ApproverDid>>,
T::Error: ::std::fmt::Display,
{
self.replaces = value
.try_into()
.map_err(|e| format!("error converting supplied value for replaces: {e}"));
self
}
pub fn statement<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AttestStatement>>,
T::Error: ::std::fmt::Display,
{
self.statement = value
.try_into()
.map_err(|e| format!("error converting supplied value for statement: {e}"));
self
}
}
impl ::std::convert::TryFrom<Payload> for super::Payload {
type Error = super::error::ConversionError;
fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
approver_did: value.approver_did?,
ext: value.ext?,
label: value.label?,
replaces: value.replaces?,
statement: value.statement?,
})
}
}
impl ::std::convert::From<super::Payload> for Payload {
fn from(value: super::Payload) -> Self {
Self {
approver_did: Ok(value.approver_did),
ext: Ok(value.ext),
label: Ok(value.label),
replaces: Ok(value.replaces),
statement: Ok(value.statement),
}
}
}
#[derive(Clone, Debug)]
pub struct Response {
approver: ::std::result::Result<super::Approver, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
}
impl ::std::default::Default for Response {
fn default() -> Self {
Self {
approver: Err("no value supplied for approver".to_string()),
ext: Ok(Default::default()),
}
}
}
impl Response {
pub fn approver<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::Approver>,
T::Error: ::std::fmt::Display,
{
self.approver = value
.try_into()
.map_err(|e| format!("error converting supplied value for approver: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
}
impl ::std::convert::TryFrom<Response> for super::Response {
type Error = super::error::ConversionError;
fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
approver: value.approver?,
ext: value.ext?,
})
}
}
impl ::std::convert::From<super::Response> for Response {
fn from(value: super::Response) -> Self {
Self {
approver: Ok(value.approver),
ext: Ok(value.ext),
}
}
}
}
impl crate::Payload for Payload {
const TYPE_URI: &'static str = "https://trusttasks.org/spec/auth/step-up/approver/enroll/0.1";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"Approver\": {\n \"additionalProperties\": false,\n \"description\": \"One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.\",\n \"properties\": {\n \"approverDid\": {\n \"$ref\": \"#/$defs/ApproverDid\"\n },\n \"enrolledAt\": {\n \"description\": \"When the binding was written.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"enrolledVia\": {\n \"$ref\": \"#/$defs/EnrolledVia\"\n },\n \"label\": {\n \"$ref\": \"#/$defs/ApproverLabel\"\n },\n \"lastUsedAt\": {\n \"description\": \"When a statement by this approver last satisfied a step-up. Absent when it never has.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"subject\": {\n \"description\": \"The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.\",\n \"maxLength\": 2048,\n \"minLength\": 5,\n \"pattern\": \"^did:\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"approverDid\",\n \"subject\",\n \"enrolledAt\",\n \"enrolledVia\"\n ],\n \"title\": \"Approver\",\n \"type\": \"object\"\n },\n \"ApproverDid\": {\n \"description\": \"A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.\",\n \"maxLength\": 128,\n \"minLength\": 16,\n \"pattern\": \"^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$\",\n \"title\": \"ApproverDid\",\n \"type\": \"string\"\n },\n \"ApproverLabel\": {\n \"description\": \"A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"title\": \"ApproverLabel\",\n \"type\": \"string\"\n },\n \"AttestStatement\": {\n \"description\": \"A complete, signed auth/step-up/approver/attest/0.1 Trust Task document — envelope, payload and proof — issued by the approver. Deliberately an open object here rather than a typed one: the consumer verifies it as a document in its own right (envelope, proof and payload against that specification's schemas), and verifies its proof over the members exactly as received, which a binding that narrowed it to a typed struct and re-serialised it could silently break.\",\n \"minProperties\": 1,\n \"title\": \"AttestStatement\",\n \"type\": \"object\"\n },\n \"EnrolledVia\": {\n \"description\": \"The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.\",\n \"enum\": [\n \"install\",\n \"invite\",\n \"selfService\",\n \"offline\"\n ],\n \"title\": \"EnrolledVia\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"description\": \"The new binding as stored.\",\n \"properties\": {\n \"approver\": {\n \"$ref\": \"#/$defs/Approver\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n }\n },\n \"required\": [\n \"approver\"\n ],\n \"title\": \"Auth — Step-up Approver Enroll — response payload\",\n \"type\": \"object\"\n }\n },\n \"$id\": \"https://trusttasks.org/spec/auth/step-up/approver/enroll/0.1\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"additionalProperties\": false,\n \"description\": \"A subject who already holds a step-up factor adds a step-up approver, optionally replacing one of theirs in the same step. The enrolment terms are this payload with `statement` removed; the new approver's statement binds a digest of them. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.\",\n \"properties\": {\n \"approverDid\": {\n \"$ref\": \"#/$defs/ApproverDid\",\n \"description\": \"The step-up approver to bind. MUST equal the statement's issuer.\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"label\": {\n \"$ref\": \"#/$defs/ApproverLabel\"\n },\n \"replaces\": {\n \"$ref\": \"#/$defs/ApproverDid\",\n \"description\": \"A live approver of the same subject to revoke in the same step. Part of the enrolment terms, so the authority evidence for adding an approver cannot be reused to remove one.\"\n },\n \"statement\": {\n \"$ref\": \"#/$defs/AttestStatement\",\n \"description\": \"The new approver's complete, signed auth/step-up/approver/attest/0.1 document with `purpose: enrol`, over the challenge of the step-up authorizing this enrolment, with `boundTo` the terms digest defined by this specification. Not part of the enrolment terms. Absent only on a send made to obtain that challenge; an enrolment executes only with it.\"\n }\n },\n \"required\": [\n \"approverDid\"\n ],\n \"title\": \"Auth — Step-up Approver Enroll — payload\",\n \"type\": \"object\"\n}\n",
);
}
impl crate::Payload for Response {
const TYPE_URI: &'static str =
"https://trusttasks.org/spec/auth/step-up/approver/enroll/0.1#response";
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"Approver\": {\n \"additionalProperties\": false,\n \"description\": \"One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.\",\n \"properties\": {\n \"approverDid\": {\n \"$ref\": \"#/$defs/ApproverDid\"\n },\n \"enrolledAt\": {\n \"description\": \"When the binding was written.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"enrolledVia\": {\n \"$ref\": \"#/$defs/EnrolledVia\"\n },\n \"label\": {\n \"$ref\": \"#/$defs/ApproverLabel\"\n },\n \"lastUsedAt\": {\n \"description\": \"When a statement by this approver last satisfied a step-up. Absent when it never has.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"subject\": {\n \"description\": \"The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.\",\n \"maxLength\": 2048,\n \"minLength\": 5,\n \"pattern\": \"^did:\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"approverDid\",\n \"subject\",\n \"enrolledAt\",\n \"enrolledVia\"\n ],\n \"title\": \"Approver\",\n \"type\": \"object\"\n },\n \"ApproverDid\": {\n \"description\": \"A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.\",\n \"maxLength\": 128,\n \"minLength\": 16,\n \"pattern\": \"^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$\",\n \"title\": \"ApproverDid\",\n \"type\": \"string\"\n },\n \"ApproverLabel\": {\n \"description\": \"A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"title\": \"ApproverLabel\",\n \"type\": \"string\"\n },\n \"AttestStatement\": {\n \"description\": \"A complete, signed auth/step-up/approver/attest/0.1 Trust Task document — envelope, payload and proof — issued by the approver. Deliberately an open object here rather than a typed one: the consumer verifies it as a document in its own right (envelope, proof and payload against that specification's schemas), and verifies its proof over the members exactly as received, which a binding that narrowed it to a typed struct and re-serialised it could silently break.\",\n \"minProperties\": 1,\n \"title\": \"AttestStatement\",\n \"type\": \"object\"\n },\n \"EnrolledVia\": {\n \"description\": \"The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.\",\n \"enum\": [\n \"install\",\n \"invite\",\n \"selfService\",\n \"offline\"\n ],\n \"title\": \"EnrolledVia\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"description\": \"The new binding as stored.\",\n \"properties\": {\n \"approver\": {\n \"$ref\": \"#/$defs/Approver\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n }\n },\n \"required\": [\n \"approver\"\n ],\n \"title\": \"Auth — Step-up Approver Enroll — response payload\",\n \"type\": \"object\"\n }\n },\n \"$ref\": \"#/$defs/Response\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
);
}
impl crate::RequestPayload for Payload {
type Response = Response;
}
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] = &[
error_codes::SUBJECT_MISMATCH,
error_codes::NO_FACTOR_HELD,
error_codes::STATEMENT_INVALID,
error_codes::APPROVER_NOT_DISTINCT,
error_codes::APPROVER_ALREADY_BOUND,
error_codes::TOO_MANY_APPROVERS,
error_codes::REPLACE_NOT_FOUND,
];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
/// `auth/step-up/approver/enroll:subjectMismatch`
///
/// The document is not signed by a verification method of the issuer's own DID document. A signing-key or console delegation acting for the subject, or the approver being enrolled, does not satisfy this: every enrolment carries the subject's own signature.
///
/// Declared `retryable: false`.
pub const SUBJECT_MISMATCH: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/enroll:subjectMismatch",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `auth/step-up/approver/enroll:noFactorHeld`
///
/// The subject holds no step-up factor from which a self-service enrolment could be authorized. Ask an administrator for an auth/step-up/approver/invite; a subject never invites themselves.
///
/// Declared `retryable: false`.
pub const NO_FACTOR_HELD: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/enroll:noFactorHeld",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `auth/step-up/approver/enroll:statementInvalid`
///
/// `statement` is absent from an enrolment whose authority evidence was accepted, or is not a valid auth/step-up/approver/attest/0.1 document for it: its proof does not verify, its issuer is not `approverDid`, its `recipient` or `audience` is not this relying party, its `purpose` is not `enrol`, its `subject` is not the subject, its `challenge` is not the challenge of the step-up that authorized this enrolment, its `boundTo` is not this enrolment's terms digest, it was issued outside that step-up's lifetime, or its `id` was already spent.
///
/// Declared `retryable: false`.
pub const STATEMENT_INVALID: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/enroll:statementInvalid",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `auth/step-up/approver/enroll:approverNotDistinct`
///
/// `approverDid` is the subject's own DID, appears as a verification method in the subject's DID document, is a key the subject signs operations with at the relying party, or holds standing of its own there.
///
/// Declared `retryable: false`.
pub const APPROVER_NOT_DISTINCT: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/enroll:approverNotDistinct",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `auth/step-up/approver/enroll:approverAlreadyBound`
///
/// `approverDid` is already bound — to this subject or another — or was bound and revoked. Generate a new one.
///
/// Declared `retryable: false`.
pub const APPROVER_ALREADY_BOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/enroll:approverAlreadyBound",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `auth/step-up/approver/enroll:tooManyApprovers`
///
/// The subject already holds five live approvers and the enrolment names no `replaces`. Enrol again naming one in `replaces`, or revoke one first.
///
/// Declared `retryable: false`.
pub const TOO_MANY_APPROVERS: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/enroll:tooManyApprovers",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `auth/step-up/approver/enroll:replaceNotFound`
///
/// `replaces` names no live approver of this subject. The same answer is given for an approver that does not exist, was revoked, or is bound to someone else.
///
/// Declared `retryable: false`.
pub const REPLACE_NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/enroll:replaceNotFound",
retryable: false,
details_schema: ::core::option::Option::None,
};
}