Enum AuthError 

#[non_exhaustive]
pub enum AuthError {
    Missing {
        source_hint: Option<String>,
    },
    Refused {
        message: String,
    },
    Expired {
        message: Option<String>,
    },
    SourceUnreachable {
        message: String,
    },
}

Typed credential failure. Public APIs raise Error::Auth which wraps this enum; downstream layers (retry policies, circuit breakers, dashboards) can match on the variant rather than on a stringly-typed Error::Provider blob.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Missing

No credential is configured for the requested scope. Most often a deployment-time misconfiguration: the operator forgot to wire a CredentialProvider into the transport, or a chained provider exhausted every source without finding one.

Fields

source_hint: Option<String>

Human-readable hint about which source was expected ("env:ANTHROPIC_API_KEY", "vault:secret/llm").

Refused

The credential resolved successfully but the provider rejected it (HTTP 401/403, vendor-specific “invalid token” payloads). Distinct from Self::Expired because retries against the same source will keep failing — the operator must rotate the secret or fix the IAM grant.

Fields

message: String

Provider-supplied rejection message, normalised.

Expired

The credential’s TTL elapsed and the refresh path failed (or is not configured). Caller can react by triggering a rotation; downstream retry policies often back off briefly and retry once.

Fields

message: Option<String>

Optional detail ("refresh endpoint returned 503").

SourceUnreachable

Resolving the credential required talking to a remote service (vault, IMDS, KMS, OAuth refresh endpoint) and that service was unreachable. Distinct from Self::Refused because the credential itself may still be valid; the issue is transport to the credential source.

Fields

message: String

Description of the failed source call.

Implementations

impl AuthError

pub const fn missing() -> Self

Build a Missing variant with no source hint.

pub fn missing_from(source: impl Into<String>) -> Self

Build a Missing variant labelled with the source the caller expected ("env:OPENAI_API_KEY", "chained:[env, vault]").

pub fn refused(message: impl Into<String>) -> Self

Build a Refused variant from the provider’s rejection message.

pub const fn expired() -> Self

Build an Expired variant with no extra detail.

pub fn expired_with(message: impl Into<String>) -> Self

Build an Expired variant with refresh-path detail.

pub fn source_unreachable(message: impl Into<String>) -> Self

Build a SourceUnreachable variant.

Trait Implementations

impl Clone for AuthError

fn clone(&self) -> AuthError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AuthError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for AuthError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<AuthError> for Error

fn from(err: AuthError) -> Self

Converts to this type from the input type.