//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `auth/step-up/approver/revoke`. Version: `0.1`.
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
/// Error from a `TryFrom` or `FromStr` implementation.
pub struct ConversionError(::std::borrow::Cow<'static, str>);
impl ::std::error::Error for ConversionError {}
impl ::std::fmt::Display for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Display::fmt(&self.0, f)
}
}
impl ::std::fmt::Debug for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Debug::fmt(&self.0, f)
}
}
impl From<&'static str> for ConversionError {
fn from(value: &'static str) -> Self {
Self(value.into())
}
}
impl From<String> for ConversionError {
fn from(value: String) -> Self {
Self(value.into())
}
}
}
///One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Approver",
/// "description": "One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.",
/// "type": "object",
/// "required": [
/// "approverDid",
/// "enrolledAt",
/// "enrolledVia",
/// "subject"
/// ],
/// "properties": {
/// "approverDid": {
/// "$ref": "#/definitions/ApproverDid"
/// },
/// "enrolledAt": {
/// "description": "When the binding was written.",
/// "type": "string",
/// "format": "date-time"
/// },
/// "enrolledVia": {
/// "$ref": "#/definitions/EnrolledVia"
/// },
/// "label": {
/// "$ref": "#/definitions/ApproverLabel"
/// },
/// "lastUsedAt": {
/// "description": "When a statement by this approver last satisfied a step-up. Absent when it never has.",
/// "type": "string",
/// "format": "date-time"
/// },
/// "subject": {
/// "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 5,
/// "pattern": "^did:"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Approver {
#[serde(rename = "approverDid")]
pub approver_did: ApproverDid,
///When the binding was written.
#[serde(rename = "enrolledAt")]
pub enrolled_at: ::chrono::DateTime<::chrono::offset::Utc>,
#[serde(rename = "enrolledVia")]
pub enrolled_via: EnrolledVia,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub label: ::std::option::Option<ApproverLabel>,
///When a statement by this approver last satisfied a step-up. Absent when it never has.
#[serde(
rename = "lastUsedAt",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub last_used_at: ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
///The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.
pub subject: ApproverSubject,
}
impl Approver {
pub fn builder() -> builder::Approver {
Default::default()
}
}
///A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ApproverDid",
/// "description": "A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 16,
/// "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ApproverDid(::std::string::String);
impl ::std::ops::Deref for ApproverDid {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ApproverDid> for ::std::string::String {
fn from(value: ApproverDid) -> Self {
value.0
}
}
impl ::std::str::FromStr for ApproverDid {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
if value.chars().count() < 16usize {
return Err("shorter than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ApproverDid {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ApproverDid {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ApproverDid {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ApproverDid {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ApproverLabel",
/// "description": "A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.",
/// "type": "string",
/// "maxLength": 64,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ApproverLabel(::std::string::String);
impl ::std::ops::Deref for ApproverLabel {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ApproverLabel> for ::std::string::String {
fn from(value: ApproverLabel) -> Self {
value.0
}
}
impl ::std::str::FromStr for ApproverLabel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ApproverLabel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ApproverLabel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ApproverLabel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ApproverLabel {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 5,
/// "pattern": "^did:"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ApproverSubject(::std::string::String);
impl ::std::ops::Deref for ApproverSubject {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ApproverSubject> for ::std::string::String {
fn from(value: ApproverSubject) -> Self {
value.0
}
}
impl ::std::str::FromStr for ApproverSubject {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
if value.chars().count() < 5usize {
return Err("shorter than 5 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^did:").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ApproverSubject {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ApproverSubject {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ApproverSubject {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ApproverSubject {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "EnrolledVia",
/// "description": "The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.",
/// "type": "string",
/// "enum": [
/// "install",
/// "invite",
/// "selfService",
/// "offline"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum EnrolledVia {
#[serde(rename = "install")]
Install,
#[serde(rename = "invite")]
Invite,
#[serde(rename = "selfService")]
SelfService,
#[serde(rename = "offline")]
Offline,
}
impl ::std::fmt::Display for EnrolledVia {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Install => f.write_str("install"),
Self::Invite => f.write_str("invite"),
Self::SelfService => f.write_str("selfService"),
Self::Offline => f.write_str("offline"),
}
}
}
impl ::std::str::FromStr for EnrolledVia {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"install" => Ok(Self::Install),
"invite" => Ok(Self::Invite),
"selfService" => Ok(Self::SelfService),
"offline" => Ok(Self::Offline),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for EnrolledVia {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for EnrolledVia {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for EnrolledVia {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Ext",
/// "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
/// "type": "object",
/// "minProperties": 1,
/// "additionalProperties": true,
/// "propertyNames": {
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
/// }
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
fn from(value: Ext) -> Self {
value.0
}
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
Self(value)
}
}
///`ExtKey`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
fn from(value: ExtKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExtKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "$id": "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1",
/// "title": "Payload",
/// "description": "Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
/// "type": "object",
/// "required": [
/// "approverDid"
/// ],
/// "properties": {
/// "approverDid": {
/// "description": "The approver to revoke.",
/// "$ref": "#/definitions/ApproverDid"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "reason": {
/// "description": "Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.",
/// "type": "string",
/// "maxLength": 500,
/// "minLength": 1
/// },
/// "subject": {
/// "description": "The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 5,
/// "pattern": "^did:"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
///The approver to revoke.
#[serde(rename = "approverDid")]
pub approver_did: ApproverDid,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
///Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub reason: ::std::option::Option<PayloadReason>,
///The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub subject: ::std::option::Option<PayloadSubject>,
}
impl Payload {
pub fn builder() -> builder::Payload {
Default::default()
}
}
///Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.",
/// "type": "string",
/// "maxLength": 500,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct PayloadReason(::std::string::String);
impl ::std::ops::Deref for PayloadReason {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<PayloadReason> for ::std::string::String {
fn from(value: PayloadReason) -> Self {
value.0
}
}
impl ::std::str::FromStr for PayloadReason {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 500usize {
return Err("longer than 500 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for PayloadReason {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for PayloadReason {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for PayloadReason {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for PayloadReason {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 5,
/// "pattern": "^did:"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct PayloadSubject(::std::string::String);
impl ::std::ops::Deref for PayloadSubject {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<PayloadSubject> for ::std::string::String {
fn from(value: PayloadSubject) -> Self {
value.0
}
}
impl ::std::str::FromStr for PayloadSubject {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
if value.chars().count() < 5usize {
return Err("shorter than 5 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^did:").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for PayloadSubject {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for PayloadSubject {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for PayloadSubject {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for PayloadSubject {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The revoked binding, when it was revoked, and how many approvers the subject still holds.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Response",
/// "description": "The revoked binding, when it was revoked, and how many approvers the subject still holds.",
/// "type": "object",
/// "required": [
/// "remainingApprovers",
/// "revoked",
/// "revokedAt"
/// ],
/// "properties": {
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "remainingApprovers": {
/// "description": "The subject's live approvers after the revocation. Zero is legitimate and recoverable.",
/// "type": "integer",
/// "maximum": 5.0,
/// "minimum": 0.0
/// },
/// "revoked": {
/// "$ref": "#/definitions/Approver"
/// },
/// "revokedAt": {
/// "description": "When the binding was revoked — the original time when the approver was already revoked.",
/// "type": "string",
/// "format": "date-time"
/// }
/// },
/// "additionalProperties": false,
/// "$anchor": "response"
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
///The subject's live approvers after the revocation. Zero is legitimate and recoverable.
#[serde(rename = "remainingApprovers")]
pub remaining_approvers: i64,
pub revoked: Approver,
///When the binding was revoked — the original time when the approver was already revoked.
#[serde(rename = "revokedAt")]
pub revoked_at: ::chrono::DateTime<::chrono::offset::Utc>,
}
impl Response {
pub fn builder() -> builder::Response {
Default::default()
}
}
/// Types for composing complex structures.
pub mod builder {
#[derive(Clone, Debug)]
pub struct Approver {
approver_did: ::std::result::Result<super::ApproverDid, ::std::string::String>,
enrolled_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
enrolled_via: ::std::result::Result<super::EnrolledVia, ::std::string::String>,
label: ::std::result::Result<
::std::option::Option<super::ApproverLabel>,
::std::string::String,
>,
last_used_at: ::std::result::Result<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
::std::string::String,
>,
subject: ::std::result::Result<super::ApproverSubject, ::std::string::String>,
}
impl ::std::default::Default for Approver {
fn default() -> Self {
Self {
approver_did: Err("no value supplied for approver_did".to_string()),
enrolled_at: Err("no value supplied for enrolled_at".to_string()),
enrolled_via: Err("no value supplied for enrolled_via".to_string()),
label: Ok(Default::default()),
last_used_at: Ok(Default::default()),
subject: Err("no value supplied for subject".to_string()),
}
}
}
impl Approver {
pub fn approver_did<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ApproverDid>,
T::Error: ::std::fmt::Display,
{
self.approver_did = value
.try_into()
.map_err(|e| format!("error converting supplied value for approver_did: {e}"));
self
}
pub fn enrolled_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.enrolled_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for enrolled_at: {e}"));
self
}
pub fn enrolled_via<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::EnrolledVia>,
T::Error: ::std::fmt::Display,
{
self.enrolled_via = value
.try_into()
.map_err(|e| format!("error converting supplied value for enrolled_via: {e}"));
self
}
pub fn label<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::ApproverLabel>>,
T::Error: ::std::fmt::Display,
{
self.label = value
.try_into()
.map_err(|e| format!("error converting supplied value for label: {e}"));
self
}
pub fn last_used_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
>,
T::Error: ::std::fmt::Display,
{
self.last_used_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for last_used_at: {e}"));
self
}
pub fn subject<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ApproverSubject>,
T::Error: ::std::fmt::Display,
{
self.subject = value
.try_into()
.map_err(|e| format!("error converting supplied value for subject: {e}"));
self
}
}
impl ::std::convert::TryFrom<Approver> for super::Approver {
type Error = super::error::ConversionError;
fn try_from(value: Approver) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
approver_did: value.approver_did?,
enrolled_at: value.enrolled_at?,
enrolled_via: value.enrolled_via?,
label: value.label?,
last_used_at: value.last_used_at?,
subject: value.subject?,
})
}
}
impl ::std::convert::From<super::Approver> for Approver {
fn from(value: super::Approver) -> Self {
Self {
approver_did: Ok(value.approver_did),
enrolled_at: Ok(value.enrolled_at),
enrolled_via: Ok(value.enrolled_via),
label: Ok(value.label),
last_used_at: Ok(value.last_used_at),
subject: Ok(value.subject),
}
}
}
#[derive(Clone, Debug)]
pub struct Payload {
approver_did: ::std::result::Result<super::ApproverDid, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
reason: ::std::result::Result<
::std::option::Option<super::PayloadReason>,
::std::string::String,
>,
subject: ::std::result::Result<
::std::option::Option<super::PayloadSubject>,
::std::string::String,
>,
}
impl ::std::default::Default for Payload {
fn default() -> Self {
Self {
approver_did: Err("no value supplied for approver_did".to_string()),
ext: Ok(Default::default()),
reason: Ok(Default::default()),
subject: Ok(Default::default()),
}
}
}
impl Payload {
pub fn approver_did<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ApproverDid>,
T::Error: ::std::fmt::Display,
{
self.approver_did = value
.try_into()
.map_err(|e| format!("error converting supplied value for approver_did: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn reason<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::PayloadReason>>,
T::Error: ::std::fmt::Display,
{
self.reason = value
.try_into()
.map_err(|e| format!("error converting supplied value for reason: {e}"));
self
}
pub fn subject<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::PayloadSubject>>,
T::Error: ::std::fmt::Display,
{
self.subject = value
.try_into()
.map_err(|e| format!("error converting supplied value for subject: {e}"));
self
}
}
impl ::std::convert::TryFrom<Payload> for super::Payload {
type Error = super::error::ConversionError;
fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
approver_did: value.approver_did?,
ext: value.ext?,
reason: value.reason?,
subject: value.subject?,
})
}
}
impl ::std::convert::From<super::Payload> for Payload {
fn from(value: super::Payload) -> Self {
Self {
approver_did: Ok(value.approver_did),
ext: Ok(value.ext),
reason: Ok(value.reason),
subject: Ok(value.subject),
}
}
}
#[derive(Clone, Debug)]
pub struct Response {
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
remaining_approvers: ::std::result::Result<i64, ::std::string::String>,
revoked: ::std::result::Result<super::Approver, ::std::string::String>,
revoked_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
}
impl ::std::default::Default for Response {
fn default() -> Self {
Self {
ext: Ok(Default::default()),
remaining_approvers: Err("no value supplied for remaining_approvers".to_string()),
revoked: Err("no value supplied for revoked".to_string()),
revoked_at: Err("no value supplied for revoked_at".to_string()),
}
}
}
impl Response {
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn remaining_approvers<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<i64>,
T::Error: ::std::fmt::Display,
{
self.remaining_approvers = value.try_into().map_err(|e| {
format!("error converting supplied value for remaining_approvers: {e}")
});
self
}
pub fn revoked<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::Approver>,
T::Error: ::std::fmt::Display,
{
self.revoked = value
.try_into()
.map_err(|e| format!("error converting supplied value for revoked: {e}"));
self
}
pub fn revoked_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.revoked_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for revoked_at: {e}"));
self
}
}
impl ::std::convert::TryFrom<Response> for super::Response {
type Error = super::error::ConversionError;
fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
ext: value.ext?,
remaining_approvers: value.remaining_approvers?,
revoked: value.revoked?,
revoked_at: value.revoked_at?,
})
}
}
impl ::std::convert::From<super::Response> for Response {
fn from(value: super::Response) -> Self {
Self {
ext: Ok(value.ext),
remaining_approvers: Ok(value.remaining_approvers),
revoked: Ok(value.revoked),
revoked_at: Ok(value.revoked_at),
}
}
}
}
impl crate::Payload for Payload {
const TYPE_URI: &'static str = "https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"Approver\": {\n \"additionalProperties\": false,\n \"description\": \"One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.\",\n \"properties\": {\n \"approverDid\": {\n \"$ref\": \"#/$defs/ApproverDid\"\n },\n \"enrolledAt\": {\n \"description\": \"When the binding was written.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"enrolledVia\": {\n \"$ref\": \"#/$defs/EnrolledVia\"\n },\n \"label\": {\n \"$ref\": \"#/$defs/ApproverLabel\"\n },\n \"lastUsedAt\": {\n \"description\": \"When a statement by this approver last satisfied a step-up. Absent when it never has.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"subject\": {\n \"description\": \"The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.\",\n \"maxLength\": 2048,\n \"minLength\": 5,\n \"pattern\": \"^did:\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"approverDid\",\n \"subject\",\n \"enrolledAt\",\n \"enrolledVia\"\n ],\n \"title\": \"Approver\",\n \"type\": \"object\"\n },\n \"ApproverDid\": {\n \"description\": \"A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.\",\n \"maxLength\": 128,\n \"minLength\": 16,\n \"pattern\": \"^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$\",\n \"title\": \"ApproverDid\",\n \"type\": \"string\"\n },\n \"ApproverLabel\": {\n \"description\": \"A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"title\": \"ApproverLabel\",\n \"type\": \"string\"\n },\n \"EnrolledVia\": {\n \"description\": \"The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.\",\n \"enum\": [\n \"install\",\n \"invite\",\n \"selfService\",\n \"offline\"\n ],\n \"title\": \"EnrolledVia\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"description\": \"The revoked binding, when it was revoked, and how many approvers the subject still holds.\",\n \"properties\": {\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"remainingApprovers\": {\n \"description\": \"The subject's live approvers after the revocation. Zero is legitimate and recoverable.\",\n \"maximum\": 5,\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"revoked\": {\n \"$ref\": \"#/$defs/Approver\"\n },\n \"revokedAt\": {\n \"description\": \"When the binding was revoked — the original time when the approver was already revoked.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"revoked\",\n \"revokedAt\",\n \"remainingApprovers\"\n ],\n \"title\": \"Auth — Step-up Approver Revoke — response payload\",\n \"type\": \"object\"\n }\n },\n \"$id\": \"https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"additionalProperties\": false,\n \"description\": \"Revoke one step-up approver binding — the caller's own, or another subject's within an administrator's authority. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.\",\n \"properties\": {\n \"approverDid\": {\n \"$ref\": \"#/$defs/ApproverDid\",\n \"description\": \"The approver to revoke.\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"reason\": {\n \"description\": \"Why the approver is revoked, for the audit record. Free text authored by the caller, untrusted, never published beyond the subject and the administrators over them.\",\n \"maxLength\": 500,\n \"minLength\": 1,\n \"type\": \"string\"\n },\n \"subject\": {\n \"description\": \"The subject the approver is bound to. Absent means the caller; an administrator revoking on someone's behalf names it.\",\n \"maxLength\": 2048,\n \"minLength\": 5,\n \"pattern\": \"^did:\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"approverDid\"\n ],\n \"title\": \"Auth — Step-up Approver Revoke — payload\",\n \"type\": \"object\"\n}\n",
);
}
impl crate::Payload for Response {
const TYPE_URI: &'static str =
"https://trusttasks.org/spec/auth/step-up/approver/revoke/0.1#response";
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"Approver\": {\n \"additionalProperties\": false,\n \"description\": \"One step-up approver binding, as its subject or an administrator sees it. The binding confers nothing of its own: it is read only when the relying party checks the evidence of a step-up asked of `subject`.\",\n \"properties\": {\n \"approverDid\": {\n \"$ref\": \"#/$defs/ApproverDid\"\n },\n \"enrolledAt\": {\n \"description\": \"When the binding was written.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"enrolledVia\": {\n \"$ref\": \"#/$defs/EnrolledVia\"\n },\n \"label\": {\n \"$ref\": \"#/$defs/ApproverLabel\"\n },\n \"lastUsedAt\": {\n \"description\": \"When a statement by this approver last satisfied a step-up. Absent when it never has.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"subject\": {\n \"description\": \"The one subject DID this approver is bound to. An approver DID is bound to at most one subject at a relying party.\",\n \"maxLength\": 2048,\n \"minLength\": 5,\n \"pattern\": \"^did:\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"approverDid\",\n \"subject\",\n \"enrolledAt\",\n \"enrolledVia\"\n ],\n \"title\": \"Approver\",\n \"type\": \"object\"\n },\n \"ApproverDid\": {\n \"description\": \"A step-up approver, as an Ed25519 `did:key` (`z6Mk…`). `did:key` only, because its document is a function of the key and resolves with no network, so verifying an approver's statement never depends on a fetch, and a key whose DID document could be rewritten after enrolment would not be the key that was enrolled. Distinct from the subject's DID, from every verification method in the subject's DID document, and from every key the subject can sign operations with at the relying party.\",\n \"maxLength\": 128,\n \"minLength\": 16,\n \"pattern\": \"^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$\",\n \"title\": \"ApproverDid\",\n \"type\": \"string\"\n },\n \"ApproverLabel\": {\n \"description\": \"A human-readable name for where the approver lives — e.g. `Browser plugin — work laptop`. Chosen by the subject (or suggested by an inviter), untrusted, and attributed to its author wherever it is rendered. Absent rather than invented when none was chosen.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"title\": \"ApproverLabel\",\n \"type\": \"string\"\n },\n \"EnrolledVia\": {\n \"description\": \"The anchor the binding rested on, recorded so an incident review can see how each factor came to exist. `install`: claimed with the community's install token (vtc/install/claim/finish/0.3). `invite`: redeemed from an administrator's invite (auth/step-up/approver/redeem/finish/0.1). `selfService`: added by the subject behind a factor they already held (auth/step-up/approver/enroll/0.1). `offline`: redeemed from an invite minted by the operator with host access while the service was stopped — an `invite`-shaped redemption whose issuer was the host rather than an administrator.\",\n \"enum\": [\n \"install\",\n \"invite\",\n \"selfService\",\n \"offline\"\n ],\n \"title\": \"EnrolledVia\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"description\": \"The revoked binding, when it was revoked, and how many approvers the subject still holds.\",\n \"properties\": {\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"remainingApprovers\": {\n \"description\": \"The subject's live approvers after the revocation. Zero is legitimate and recoverable.\",\n \"maximum\": 5,\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"revoked\": {\n \"$ref\": \"#/$defs/Approver\"\n },\n \"revokedAt\": {\n \"description\": \"When the binding was revoked — the original time when the approver was already revoked.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"revoked\",\n \"revokedAt\",\n \"remainingApprovers\"\n ],\n \"title\": \"Auth — Step-up Approver Revoke — response payload\",\n \"type\": \"object\"\n }\n },\n \"$ref\": \"#/$defs/Response\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
);
}
impl crate::RequestPayload for Payload {
type Response = Response;
}
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] = &[error_codes::NOT_FOUND];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
/// `auth/step-up/approver/revoke:notFound`
///
/// No binding of this approver exists that the caller may revoke. Returned identically for an approver that was never bound, one bound to a different subject than `subject` names, and one bound to a subject the caller has no authority over, so the code cannot be used to probe which approvers are bound to whom.
///
/// Declared `retryable: false`.
pub const NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "auth/step-up/approver/revoke:notFound",
retryable: false,
details_schema: ::core::option::Option::None,
};
}