spacedb_access/
error.rs

1//! Errors for the access layer.
2//!
3//! Note the split: a **policy** outcome (a capability is out of scope, expired,
4//! the signature doesn't verify) is *not* an error — it is a
5//! [`Decision::Deny`](crate::Decision) with a reason, because denial is a normal,
6//! expected result. `AccessError` is reserved for genuine **system** failures
7//! (key generation, a directory backend error, canonicalization).
8
9use thiserror::Error;
10
11pub type AccessResult<T> = Result<T, AccessError>;
12
13#[derive(Debug, Error)]
14pub enum AccessError {
15    /// Key generation failed (OS randomness unavailable, or an invalid scalar).
16    #[error("key generation: {0}")]
17    KeyGen(String),
18
19    /// A public key could not be parsed.
20    #[error("invalid key: {0}")]
21    InvalidKey(String),
22
23    /// A capability could not be canonicalized for signing/verification.
24    #[error("canonicalization: {0}")]
25    Canonical(String),
26
27    /// The key directory backend failed (not "key absent" — that is a Deny).
28    #[error("directory: {0}")]
29    Directory(String),
30}
spacedb_access/error.rs

spacedb_access/
error.rs
