Enum BackupPolicy 

pub enum BackupPolicy {
    Allow,
    RequireDeviceBound,
}

Policy for multi-device (syncable) credentials — the WebAuthn L3 BE/BS story.

BE (backup eligibility) is an immutable creation-time property: “this credential may be backed up / synced”. BS (backup state) says whether it currently is. Both arrive in the signed authenticator data flags and are reported on both ceremony results.

Account-recovery implications

• A synced (BE=1) credential lives in a cloud account (iCloud Keychain, Google Password Manager, …). Account recovery therefore follows the platform’s rules — a phone number or recovery email can resurrect the credential. Treat these like a possession factor that inherits the recovery strength of the user’s cloud account.
• A device-bound (BE=0) credential is confined to one hardware authenticator; losing the device means losing the credential (stronger possession semantics, worse recovery story).
• RPs that want to exclude synced credentials from sensitive flows use BackupPolicy::RequireDeviceBound, which rejects BE=1 credentials.

Variants

Allow

Accept device-bound and synced credentials; report the flags (default).

RequireDeviceBound

Reject BE=1 (syncable) credentials at both ceremonies.

Trait Implementations

impl Clone for BackupPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for BackupPolicy

impl Debug for BackupPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for BackupPolicy

fn default() -> Self

Returns the “default value” for a type.

impl Eq for BackupPolicy

impl PartialEq for BackupPolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for BackupPolicy