oas-attestation · error

#[derive(Debug, Error)]
pub enum AttestationError {
    /// The issuer DID is not a valid `did:oas` identifier.
    #[error("invalid issuer DID: {issuer}")]
    InvalidIssuer {
        /// The invalid issuer DID.
        issuer: String,
    },

    /// The credential subject DID is not a valid `did:oas` identifier.
    #[error("invalid credential subject DID: {subject}")]
    InvalidSubject {
        /// The invalid subject DID.
        subject: String,
    },

    /// The attestation type is not recognized.
    #[error("unrecognized attestation type: '{found}'")]
    UnknownAttestationType {
        /// The unrecognized type.
        found: String,
    },

    /// The credential proof is missing.
    #[error("credential proof is missing")]
    MissingProof,

    /// The credential proof signature is invalid.
    #[error("credential proof signature invalid: {reason}")]
    InvalidProofSignature {
        /// Details about the signature failure.
        reason: String,
    },

    /// Proof generation failed.
    #[error("credential proof generation failed: {reason}")]
    ProofGenerationFailed {
        /// Details about the failure.
        reason: String,
    },

    /// The credential has expired.
    #[error("credential expired at {expiration}")]
    Expired {
        /// The expiration timestamp.
        expiration: String,
    },

    /// The credential is not yet valid.
    #[error("credential not valid until {valid_from}")]
    NotYetValid {
        /// The earliest valid timestamp.
        valid_from: String,
    },

    /// A required field is missing from the credential subject.
    #[error("credential subject missing required field: '{field}'")]
    MissingField {
        /// The missing field name.
        field: String,
    },

    /// The presentation's challenge (nonce) does not match the verifier's
    /// expected value. Per OAS Spec §14.5, replay protection requires the
    /// presentation proof to bind a verifier-supplied nonce; mismatches MUST
    /// cause rejection.
    #[error(
        "presentation challenge mismatch: expected '{expected}', got '{actual}' (replay \
         protection per OAS Spec §14.5)"
    )]
    PresentationChallengeMismatch {
        /// The verifier-supplied nonce.
        expected: String,
        /// The nonce embedded in the presentation proof.
        actual: String,
    },

    /// The presentation's domain (audience) does not match the verifier's
    /// identifier. Per OAS Spec §14.5, the audience prevents cross-verifier
    /// replay; mismatches MUST cause rejection.
    #[error(
        "presentation domain mismatch: expected '{expected}', got '{actual}' (audience \
         binding per OAS Spec §14.5)"
    )]
    PresentationDomainMismatch {
        /// The verifier's identifier.
        expected: String,
        /// The domain embedded in the presentation proof.
        actual: String,
    },

    /// A holder lineage chain submitted for §14.5.1 descendant-form holder
    /// binding check is structurally invalid: chain continuity is broken
    /// (a proof's `parent_did` does not match the next proof's `child_did`),
    /// the chain does not start at the presentation holder, or one of the
    /// proofs failed cryptographic verification.
    #[error("holder lineage chain invalid: {reason} (OAS Spec §14.5.1)")]
    LineageChainInvalid {
        /// Specific reason the chain failed validation.
        reason: String,
    },

    /// The presentation violates the Holder Binding Rule from OAS Spec
    /// §14.5.1: an authority-bearing attestation (e.g., `CapabilityVerification`)
    /// is being presented by a holder whose DID is neither the credential
    /// subject nor a lineage descendant of the subject.
    #[error(
        "holder binding violation: holder '{holder}' is not the subject (or a lineage \
         descendant of) authority-bearing credential subject '{subject}' for attestation \
         type '{attestation_type}' (OAS Spec §14.5.1)"
    )]
    HolderBindingViolation {
        /// The presentation holder DID.
        holder: String,
        /// The authority-bearing credential subject DID.
        subject: String,
        /// The credential's attestation type (e.g., `CapabilityVerification`).
        attestation_type: String,
    },

    /// The proof format identifier is not in the OAS proof format registry
    /// (Spec §14.4). Per spec, verifiers MUST reject credentials whose proof
    /// format is unrecognized; callers SHOULD propagate this error.
    #[error(
        "unknown proof format identifier: '{format_id}' is not in the OAS \
         §14.4 registry; expected one of \
         'https://openagent.id/proof/ed25519-2020', \
         'https://openagent.id/proof/vc-jose', \
         'https://openagent.id/proof/sd-jwt-vc', \
         'https://openagent.id/proof/data-integrity-2025'"
    )]
    UnknownProofFormat {
        /// The unrecognized format identifier as presented on the wire.
        format_id: String,
    },

    /// A JSON serialization error.
    #[error("JSON error: {0}")]
    Json(#[from] serde_json::Error),

    /// An underlying cryptographic error.
    #[error("cryptographic error: {0}")]
    Crypto(#[from] oas_crypto::CryptoError),
}