Enum AuthError 

#[non_exhaustive]
pub enum AuthError {
    Expired,
    Denied,
    Network(Error),
    Transport(String),
    Protocol(String),
    MigrationRequired,
    NotAccountOwner {
        allowed_roles: String,
    },
    CapiDisabled,
    UnknownAccount {
        requested: u64,
        available: String,
    },
    AccountRequired(String),
    MfaRequired {
        factors: Vec<String>,
    },
    MfaInvalidCode,
    MfaQuotaExceeded,
}

Errors from the OIDC token-acquisition flows.

Exit-code mapping is applied at the CLI layer in the error-contract work unit; here we only classify the failure.

#[non_exhaustive]: classifying a failure more precisely means a new variant — Transport below is one, and it is not the last — and this enum is part of the supported redisctl-core library surface, where an exhaustive downstream match would make each of those a major release. Match a wildcard arm and treat it as an unclassified failure.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Expired

The device/authorization code expired before the user approved (expired_token).

Denied

The user denied the authorization request (access_denied).

Network(Error)

Network/transport failure talking to the SM API.

Transport(String)

The same failure from an oauth2 flow, which runs on that crate’s own HTTP stack and so produces an error type AuthError::Network cannot hold. Carried separately rather than folded into AuthError::Protocol: a request that never arrived says nothing about the credentials, and is worth retrying.

Protocol(String)

The identity provider returned something unexpected or unparseable.

MigrationRequired

The Redis Cloud account still authenticates with a password and has not been linked to a social/SSO identity, so the token exchange cannot complete. Linking is a one-time step the user performs in the Redis Cloud console.

NotAccountOwner

The signed-in user’s role on the account does not permit programmatic (CAPI) access, so the login cannot mint a key. A one-time step for someone who does hold the role, not a retryable failure. allowed_roles is what SM reported as sufficient, already formatted.

Fields

allowed_roles: String

CapiDisabled

The account itself has API access switched off, so no role can mint a key. Only Redis can turn it back on — it is not exposed to account owners.

UnknownAccount

--account named an account the signed-in user does not belong to. Carries what they do have, so the caller can list the options instead of just refusing.

Fields

requested: u64

available: String

AccountRequired(String)

No usable account choice: none was given where one is required, or the caller gave up. A precondition for the caller to fix, not a backend failure.

MfaRequired

SM challenged the login for multi-factor authentication (user-mfa-required). Carries the factor types SM offered, when it reports them.

Fields

factors: Vec<String>

MfaInvalidCode

The submitted MFA code was rejected (mfa-invalid-code).

MfaQuotaExceeded

Too many MFA attempts (mfa-quota-exceeded); retrying now will not help.

Trait Implementations

impl Debug for AuthError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AuthError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for AuthError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Error> for AuthError

fn from(source: Error) -> Self

Converts to this type from the input type.