Enum CallbackError 

#[non_exhaustive]
pub enum CallbackError {
    NoPendingAuthorization,
    StateMismatch,
    AuthorizationDenied {
        error: String,
        description: Option<String>,
    },
    MalformedCallback(&'static str),
    TokenExchange(String),
    ScopeNotCovered(ScopeNotCovered),
    MissingRefreshToken,
    TokenStore(String),
}

NativeAuthFlow::complete failure surface.

Every variant is terminal for the attempt that produced it; none is retryable with the same callback.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

NoPendingAuthorization

No authorization was pending — complete ran without a preceding start, or a second callback arrived for an attempt already consumed.

Load-bearing: the pending slot is taken unconditionally, before the state is compared, so a replayed callback lands here regardless of whether the first attempt succeeded. Single-use is the property; this variant is what it looks like from outside.

StateMismatch

The returned state did not match the pending one — the CSRF defense (RFC 6749 §10.12). The attempt is consumed either way.

AuthorizationDenied

The authorization server redirected with an error instead of a code (RFC 6749 §4.1.2.1) — most commonly access_denied, the user declining at the consent screen.

Fields

error: String

The RFC 6749 §4.1.2.1 error code, verbatim.

description: Option<String>

The server’s human-readable elaboration, when present.

MalformedCallback(&'static str)

The redirect query was neither a valid success nor a valid error response — no code, no error, or no state.

TokenExchange(String)

The token endpoint rejected the exchange.

ScopeNotCovered(ScopeNotCovered)

The exchange succeeded but the granted scope does not cover the requested tier. Fails here, at sign-in, rather than an hour later on the first call that needs the missing atom.

MissingRefreshToken

The token response carried no refresh_token, so no durable credential can be built from it. A native client that cannot renew would silently sign the user out within the hour.

TokenStore(String)

The keystore rejected the write.

Trait Implementations

impl Debug for CallbackError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for CallbackError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for CallbackError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<ScopeNotCovered> for CallbackError

fn from(source: ScopeNotCovered) -> Self

Converts to this type from the input type.