Enum AuthorityError 

pub enum AuthorityError {
    EmptyChain,
    Digest {
        index: usize,
        reason: String,
    },
    NoExpiry {
        index: usize,
    },
    TooDeep {
        found: usize,
    },
    NotAuthority {
        index: usize,
        found: String,
    },
    RootNotGoverning {
        root_issuer: String,
        expected: String,
    },
    BrokenLink {
        index: usize,
        named: String,
        presented: String,
    },
    IssuerNotParentSubject {
        index: usize,
        issuer: String,
        subject: String,
    },
    WidensActions {
        index: usize,
        action: String,
    },
    WidensScope {
        index: usize,
        scope: String,
        parent_scope: String,
    },
    OutlivesParent {
        index: usize,
        until: DateTime<Utc>,
        parent_until: DateTime<Utc>,
    },
    ScopeMismatch {
        granted: String,
        requested: String,
    },
    ActionNotGranted {
        action: String,
    },
    NotThePresenter {
        subject: String,
        presenter: String,
    },
    NotValidNow {
        index: usize,
        at: DateTime<Utc>,
    },
    NoActions {
        index: usize,
    },
}

Why a chain was refused.

Each variant names a specific way of acquiring authority that was not granted, rather than collapsing into one “invalid” — a verifier’s logs are where an escalation attempt becomes visible.

Variants

EmptyChain

The chain was empty. Nothing to verify.

Digest

A link’s digest could not be computed, or one it carries could not be read.

Distinct from AuthorityError::BrokenLink: a digest that cannot be read is not a digest that disagrees, and a verifier that conflated the two would report a malformed chain as a widening one.

Fields

index: usize

reason: String

NoExpiry

A link carried no validUntil, which a VAC MUST have.

Fields

index: usize

TooDeep

The chain is longer than MAX_CHAIN_DEPTH.

Fields

found: usize

How many links were presented.

NotAuthority

A credential in the chain was not an AuthorityCredential.

Fields

index: usize

Position in the chain, leaf first.

found: String

What was found instead.

RootNotGoverning

The chain root was not issued by the party governing the scope.

This is the finding that matters most: a chain that does not reach the governing party is a self-issued grant, however well-formed each link is.

Fields

root_issuer: String

Who actually issued the root.

expected: String

Who governs the scope being accessed.

BrokenLink

A link’s parent did not name the credential presented as its parent.

Fields

index: usize

Position in the chain, leaf first.

named: String

The id the link points at.

presented: String

The id of the credential actually presented as its parent.

IssuerNotParentSubject

A link was issued by someone other than its parent’s subject.

Only the party a grant was made to may attenuate it. Without this check a holder could graft an unrelated grant onto their own chain.

Fields

index: usize

Position in the chain, leaf first.

issuer: String

Who issued the link.

subject: String

Who the parent granted to.

WidensActions

A link conferred an action its parent did not.

Fields

index: usize

Position in the chain, leaf first.

action: String

The action that was added.

WidensScope

A link named a different scope from its parent.

Fields

index: usize

Position in the chain, leaf first.

scope: String

The link’s scope.

parent_scope: String

The parent’s scope.

OutlivesParent

A link outlived its parent.

Fields

index: usize

Position in the chain, leaf first.

until: DateTime<Utc>

The link’s expiry.

parent_until: DateTime<Utc>

The parent’s expiry.

ScopeMismatch

The requested scope is not the one the chain confers on.

Fields

granted: String

What the chain grants on.

requested: String

What was asked for.

ActionNotGranted

The chain does not confer the requested action.

Fields

action: String

The action that was requested.

NotThePresenter

The leaf grants to somebody other than the party presenting it.

A VAC is evidence that authority was conferred on somebody. It is not evidence that whoever handed it over is that somebody, and a verifier that conflated the two would authorize every captured presentation.

Fields

subject: String

Who the leaf grants to.

presenter: String

Who presented it.

NotValidNow

A link was outside its validity window at the time of the check.

Fields

index: usize

Position in the chain, leaf first.

at: DateTime<Utc>

The instant checked against.

NoActions

A link carried an empty actions list.

Fields

index: usize

Position in the chain, leaf first.

Trait Implementations

impl Clone for AuthorityError

fn clone(&self) -> AuthorityError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthorityError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AuthorityError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AuthorityError

impl Error for AuthorityError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for AuthorityError

fn eq(&self, other: &AuthorityError) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AuthorityError