Enum ValidatorError 

#[non_exhaustive]
pub enum ValidatorError {
    #[non_exhaustive]
    NoAudience {
        section: String,
    },
    #[non_exhaustive]
    NoAlgorithms {
        key: String,
    },
    #[non_exhaustive]
    LeewayTooLarge {
        key: String,
        leeway_secs: u64,
        max: u64,
    },
    HttpClient(Box<dyn Error + Send + Sync + 'static>),
    #[non_exhaustive]
    FetchTimeoutOutOfRange {
        timeout: Duration,
        min: Duration,
        max: Duration,
    },
    #[non_exhaustive]
    InvalidRootCertificate {
        index: usize,
        reason: String,
    },
    #[non_exhaustive]
    InvalidProxy {
        proxy: String,
        reason: String,
    },
    #[non_exhaustive]
    InvalidInitialJwks {
        reason: String,
    },
}

Why an OAuthValidator could not be built.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

#[non_exhaustive]

NoAudience

Neither audience nor audiences holds a value. crate::OAuthConfig::resolve refuses this; only a hand-edited ResolvedOAuthConfig reaches it.

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

section: String

The config block, named per its crate::KeyNaming.

#[non_exhaustive]

NoAlgorithms

The algorithm allowlist is empty. Refused by resolve as well.

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

key: String

The algorithms setting, named per its crate::KeyNaming.

#[non_exhaustive]

LeewayTooLarge

leeway_secs is over crate::MAX_LEEWAY_SECS. Refused by resolve as well; re-checked because a larger leeway silently extends every token’s life (and past the current Unix time, overflows the expiry arithmetic).

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

key: String

The leeway_secs setting, named per its crate::KeyNaming.

leeway_secs: u64

The configured value.

max: u64

crate::MAX_LEEWAY_SECS.

HttpClient(Box<dyn Error + Send + Sync + 'static>)

The HTTP client for metadata/JWKS fetches could not be built (in practice: the TLS backend failed to initialize).

The underlying error is boxed rather than named, so the HTTP client library’s version is not part of this crate’s public API; it is still reachable through std::error::Error::source.

#[non_exhaustive]

FetchTimeoutOutOfRange

OAuthValidatorBuilder::fetch_timeout is zero or outside crate::MIN_FETCH_TIMEOUT..=crate::MAX_FETCH_TIMEOUT.

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

timeout: Duration

The requested timeout.

min: Duration

crate::MIN_FETCH_TIMEOUT.

max: Duration

crate::MAX_FETCH_TIMEOUT.

#[non_exhaustive]

InvalidRootCertificate

A PEM passed to OAuthValidatorBuilder::add_root_certificate_pem holds no certificate, or one the TLS backend cannot parse or use as a trust anchor.

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

index: usize

Which call it came from: 0 for the first add_root_certificate_pem, 1 for the second, and so on.

reason: String

Why, for a log line. Certificates are public, so this may quote the TLS library’s error.

#[non_exhaustive]

InvalidProxy

The URL passed to OAuthValidatorBuilder::proxy is refused: malformed, or plain http on a non-loopback host with a credential in it and no allow_insecure_http.

Security

A refused value is never echoed, not even redacted — a malformed URL can hide a credential where no parser sees userinfo. proxy is only the scheme (http://<redacted>) when it is a proxy scheme, and <redacted> otherwise; reason never quotes the URL. This error is safe to log whatever the proxy URL carries.

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

proxy: String

<scheme>://<redacted>, or <redacted>: never the URL itself.

reason: String

Why.

#[non_exhaustive]

InvalidInitialJwks

The JWK Set passed to OAuthValidatorBuilder::initial_jwks is too large, not JSON, not a JWK Set, or holds no key usable for a signature under the configured algorithms.

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

reason: String

Why. Public keys only, so safe to log.

Trait Implementations

impl Debug for ValidatorError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ValidatorError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for ValidatorError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.