Enum IssueError 

pub enum IssueError {
    KeyMismatch {
        cfg_kid: String,
        signer_kid: String,
    },
    JsonEncode(String),
    ClockBackwards,
    EmissionDisallowed(String),
}

id_token-specific issuance failure modes (Phase 10.10).

Variants

KeyMismatch

IssueConfig.kid does not match the kid associated with the supplied SigningKey. Emitted before any encoding work happens so a misconfigured pipeline fails closed instead of issuing id_tokens against an unrecognized kid. Mirrors access_token::IssueError::KeyMismatch exactly — the engine’s kid-matching pre-flight is profile-agnostic, but each profile owns its own variant so audit logs don’t have to disambiguate “kid mismatch on which profile”.

Fields

cfg_kid: String

signer_kid: String

JsonEncode(String)

jsonwebtoken::encode failed at the JSON serialization step. In practice this only fires when an IssueRequest<S> field overflows the JSON number range — the registered claims are all integers within i64, so production paths cannot hit it. Listed for completeness so the engine never panics on serialization.

ClockBackwards

System clock is before UNIX_EPOCH. Cannot happen on a correctly configured machine; surfaces only on hardware-reset / NTP-broken edge cases. Listed for completeness so the engine refuses to emit garbage timestamps rather than panicking.

EmissionDisallowed(String)

β1 runtime allowlist guard (Phase 10.10) — IssueRequest<S> carries a populated PII field whose wire name is NOT in S::names(). The HasX-gated builders prevent this at the typed API surface (calling .with_email(...) on an IssueRequest<Openid> is a compile error); this variant is the runtime mirror — fires when intra-crate code bypasses the builders via pub(crate) struct-literal access and pushes a PII field through anyway. Symmetric to verify-side M72 (AuthError::UnknownClaim) — the engine refuses to emit a claim it would refuse to accept. Carries the offending wire name so audit logs see WHICH claim tripped the gate.

Trait Implementations

impl Debug for IssueError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for IssueError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for IssueError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for IssueError

fn eq(&self, other: &IssueError) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for IssueError

impl StructuralPartialEq for IssueError