Error Reference

fn response_words(id: CallId, outcome: ResponseResult) -> Result<Vec<u64>, WireError> {    let (kind, needs_commit) = outcome.code.descriptor();    if needs_commit != outcome.commit.is_some() {        return Err(BAD);    }    let mut words = vec![        id.namespace,        id.sequence,        kind,        outcome.code as u64,        u64::from(needs_commit),    ];    if let Some(commit) = outcome.commit {        words.push(u64::try_from(commit.position).map_err(|_| BAD)?);    }    Ok(words)}

fn response_core(    channel: &Channel,    params: &ResponseParameters,    atomicity: u64,    words: Vec<u64>,    original: &[u8],) -> Core {    Core {        version: Some(6),        purpose: Some(1),        deployment: Some(channel.deployment()),        source_domain: Some(channel.local()),        target_domain: Some(channel.remote()),        principal: Some(params.principal),        key_id: Some(params.key_id),        authority_epoch: Some(params.authority_epoch),        issued_seconds: Some(params.issued_seconds),        ttl_seconds: Some(params.ttl_seconds),        uuid: Some(params.uuid.to_vec()),        family: Some(5),        primary: Some(1),        secondary: None,        signature_scheme: Some(1),        atomicity: Some(atomicity),        priority: Some(3),        route_scope: Some(params.route_scope),        body: Some(Body::Ack(Operation {            opcode: Some(2),            words,            blobs: vec![original.to_vec()],            appeal_deadline: None,        })),    }}

/// Verify the peer signature and correlate a reference response against the/// canonical original retained by the caller. The configured boundary/// supplies the current peer, key and envelope policy.pub fn admit_response(    channel: &Channel,    boundary: &Boundary,    expected: &CanonicalPacket,    response: &[u8],) -> Result<VerifiedResponse, WireError> {    if channel.local() != boundary.target        || channel.remote() != boundary.source        || channel.deployment() != boundary.deployment        || boundary.now > channel.expires()        || boundary.public_key != channel.peer_keys()[1]    {        return Err(WireError::InvalidSource);    }    check_declared_version(response, boundary.max_frame)?;    let response = decode_packet(response, boundary.max_frame)?;    admit_packet(&response, channel.profile(), boundary)?;    validate_response(&response, expected, boundary.max_nesting)}

fn validate_response(    response: &CanonicalPacket,    expected: &CanonicalPacket,    max_nesting: usize,) -> Result<VerifiedResponse, WireError> {    let Operands::Response {        id,        kind,        code,        commit,        original,    } = decode(response.core(), max_nesting)?    else {        return Err(BAD);    };    let expected_operands = decode(expected.core(), 1)?;    if original != expected.core_bytes() || id != caller_id(&expected_operands)? {        return Err(WireError::ReplayConflict);    }    let code = ResponseStatus::decode(kind, code, commit.is_some())?;    if code        .known()        .is_some_and(|code| !code.matches_call(&expected_operands))    {        return Err(BAD);    }    Ok(VerifiedResponse { id, code, commit })}

/// The length of the largest response that this authority can send for the/// original, measured by encoding a response of the same shape. Every field/// of that shape has a fixed width except the embedded original Core, and the/// commit position is the only optional word, so the measured length bounds/// every response for this original.fn largest_response_len(channel: &Channel, original: &CanonicalPacket) -> Result<usize, WireError> {    let words = response_words(        CallId {            namespace: 0,            sequence: 0,        },        ResponseResult {            code: ResponseCode::Debited,            commit: Some(CommitRef { position: 0 }),        },    )?;    let mut uuid = [0; 16];    uuid[6] = 0x40;    uuid[8] = 0x80;    let params = ResponseParameters {        principal: 0,        key_id: 0,        authority_epoch: 0,        issued_seconds: 0,        ttl_seconds: 0,        uuid,        route_scope: 0,    };    let core = response_core(        channel,        &params,        response_atomicity(channel)?,        words,        original.core_bytes(),    );    Ok(encode_packet(&Packet {        core: Some(core),        signature: Some(vec![0; 64]),    })?    .len())}

fn response_original(    &self,    channel: &Channel,    bytes: &[u8],) -> Result<(CanonicalPacket, CallId), WireError> {    if channel.profile().version != 6 || !channel.profile().allows(5, 2) {        return Err(WireError::UnsupportedVersion);    }    if self.anchor.ordered_wire_control().is_none()        || self.security.ordered_revocation_profile() != Some(self.profile)        || !self.security.channel_current(channel)        || channel.deployment() != self.profile.deployment    {        return Err(WireError::InvalidSource);    }    let frame_limit = self.security.frame_limit(channel);    check_declared_version(bytes, frame_limit)?;    let original = decode_packet(bytes, frame_limit)?;    let core = original.core();    // The same operation check that runs in front of the admission gate.    super::check_operation(self.security.as_ref(), channel, core)?;    if core.version != Some(channel.profile().version)        || core.deployment != Some(channel.deployment())        || core.source_domain != Some(channel.remote())        || core.target_domain != Some(channel.local())    {        return Err(WireError::InvalidSource);    }    let id = caller_id(&decode(core, 1)?)?;    // The response embeds the original Core. A request whose response    // could not fit the frame limit is refused here, before any effect.    if largest_response_len(channel, &original)? > frame_limit {        return Err(WireError::InvalidFormat);    }    // Every check above reads only the frame and the channel. Nothing is    // signed for a frame whose own signature does not verify.    check_original_signature(channel, &original)?;    Ok((original, id))}

response_codes! {    Rejected => (1, 1, false),    Busy => (1, 2, false),    Unavailable => (1, 3, false),    OriginalRejected => (1, 4, false),    Reserved => (1, 10, true),    SourceDispatched => (1, 11, true),    Debited => (1, 12, true),    Closed => (1, 13, true),    Preempted => (1, 14, true),    TimeObserved => (1, 15, true),    Recorded => (1, 16, true),    Credited => (1, 17, true),    Reconciled => (1, 18, true),    Refunded => (1, 19, true),    DataUpdated => (1, 20, true),    EvidenceRefreshed => (1, 21, true),    Published => (1, 22, true),    DuplicateDecision => (1, 23, true),    DuplicateConfirmed => (1, 24, true),    DuplicateReversed => (1, 25, true),    LegalEmitted => (1, 26, true),    LegalApplied => (1, 27, true),    SpendExecuted => (1, 28, true),    LegalInvalidAuthority => (1, 30, false),    LegalInvalidState => (1, 31, false),    LegalInvalidBinding => (1, 32, false),    LegalMissingPriorFreeze => (1, 33, false),    LegalMissingPriorSeizure => (1, 34, false),    LegalAppealStillOpen => (1, 35, false),    LegalAppealDeadlineMismatch => (1, 36, false),    LegalMissingDestination => (1, 37, false),    LegalConflictingOrder => (1, 38, false),    Unresolved => (2, 50, false),    ResponseLost => (2, 51, false),    DeadlineExpired => (2, 52, false),    Cancelled => (2, 53, false),    TtlExpired => (2, 54, false),    DeliveryBusy => (2, 55, false),    DeliveryUnavailable => (2, 56, false),    InvalidFormat => (3, 70, false),    UnsupportedVersion => (3, 71, false),    InvalidSource => (3, 72, false),    InvalidSignature => (3, 73, false),    InvalidThresholdSignature => (3, 74, false),    TtlInvalid => (3, 75, false),    ReplayConflict => (3, 76, false),    ProductRejected => (3, 77, false),}

impl ResponseCode {    fn matches_call(self, operands: &Operands) -> bool {        use ResponseCode::*;        match operands {            Operands::Ordinary { payload, .. } => match self {                Reserved => matches!(payload.command, Command::Reserve { .. }),                SourceDispatched => matches!(payload.command, Command::Dispatch { .. }),                Debited | OriginalRejected => matches!(payload.command, Command::Debit { .. }),                Closed => matches!(                    payload.command,                    Command::Cancel { .. } | Command::Fence { .. }                ),                Preempted => matches!(payload.command, Command::Preempt { .. }),                TimeObserved => matches!(payload.command, Command::Timeout { .. }),                Recorded | EvidenceRefreshed | DuplicateDecision => {                    matches!(payload.command, Command::RecordTerminal(_))                }                Credited | DuplicateConfirmed => matches!(payload.command, Command::Credit { .. }),                Reconciled => matches!(payload.command, Command::Reconcile { .. }),                Refunded | DuplicateReversed => matches!(payload.command, Command::Refund { .. }),                DataUpdated => matches!(payload.command, Command::Write { .. }),                Published => matches!(payload.command, Command::PublishPrimary),                _ => self.is_common(),            },            Operands::Legal { stage, .. } => match self {                LegalEmitted => *stage == LegalStage::SourceEmission,                LegalApplied => *stage == LegalStage::ReceivingCommit,                LegalInvalidAuthority                | LegalInvalidState                | LegalInvalidBinding                | LegalMissingPriorFreeze                | LegalMissingPriorSeizure                | LegalAppealStillOpen                | LegalAppealDeadlineMismatch                | LegalMissingDestination                | LegalConflictingOrder => true,                _ => self.is_common(),            },            Operands::Spend { .. } => self == SpendExecuted || self.is_common(),            _ => false,        }    }    fn is_common(self) -> bool {        self.descriptor().0 != 1 || matches!(self, Self::Rejected | Self::Busy | Self::Unavailable)    }}

{  "id": "semantic-wrong-success-code",  "expected_kind": "debit",  "query_opcode": null,  "query_words": [],  "embedded": "same",  "response_words": [    7,    33,    1,    10,    1,    2  ],  "expect_error": 70,  "expect_unknown": null},

/// The result code of a verified response.#[derive(Clone, Copy, Debug, Eq, PartialEq)]pub enum ResponseStatus {    /// A code of this version, checked against its kind, its commit presence    /// and the original call.    Known(ResponseCode),    /// A code this version does not define, accepted as its category only.    /// The verifier checks the category and commit presence but cannot check    /// the code against the original call, so it never reports such a code    /// as a result of this version.    Unknown { kind: ResponseKind, code: u64 },}impl ResponseStatus {    fn decode(kind: u64, number: u64, commit: bool) -> Result<Self, WireError> {        match ResponseCode::from_number(number) {            Some(code) if code.descriptor() == (kind, commit) => Ok(Self::Known(code)),            Some(_) => Err(BAD),            None => {                let kind = ResponseKind::from_number(kind).ok_or(BAD)?;                if kind != ResponseKind::Recorded && commit {                    return Err(BAD);                }                Ok(Self::Unknown { kind, code: number })            }        }    }

{  "id": "unknown-category-1",  "expected_kind": "debit",  "query_opcode": null,  "query_words": [],  "embedded": "same",  "response_words": [    7,    33,    1,    999,    0  ],  "expect_error": null,  "expect_unknown": {    "kind": 1,    "number": 999  }},

fn error(error: WireError) -> Self {    use ResponseCode::*;    Self::plain(match error {        WireError::InvalidFormat => InvalidFormat,        WireError::UnsupportedVersion => UnsupportedVersion,        WireError::InvalidSource => InvalidSource,        WireError::InvalidSignature => InvalidSignature,        WireError::InvalidThresholdSignature => InvalidThresholdSignature,        WireError::TtlInvalid => TtlInvalid,        WireError::ReplayConflict => ReplayConflict,        WireError::ProductRejected        | WireError::Recovery(RecoveryError::Endpoint(EndpointError::Rejected)) => {            ProductRejected        }        WireError::TtlExpired => TtlExpired,        WireError::Cancelled => Cancelled,        WireError::DeadlineExpired => DeadlineExpired,        WireError::ResponseLost => ResponseLost,        WireError::RequestUnresolved => Unresolved,        WireError::Recovery(RecoveryError::Endpoint(EndpointError::Unavailable)) => {            DeliveryUnavailable        }        WireError::Recovery(_) => Unresolved,    })}

/// Verify the signature of a received original with the peer key that the/// channel authenticated, before any answer about the frame is signed. A frame/// that fails here receives only an unsigned error. The check reads the frame/// and the channel key, and no registration of the principal, key or epoch/// that the frame names, so the error cannot reveal that registration.fn check_original_signature(channel: &Channel, original: &CanonicalPacket) -> Result<(), WireError> {    let scheme = original.core().signature_scheme.ok_or(BAD)?;    if scheme == 2 {        return Err(WireError::InvalidThresholdSignature);    }    if !channel.profile().schemes.contains(&scheme)        || !verify(            &channel.peer_keys()[1],            &original.signing_bytes()?,            original.signature(),        )    {        return Err(WireError::InvalidSignature);    }    Ok(())}

/// Execute the signed call and return its correlated response after the/// existing authority transaction returns. Only call frames with a/// caller-qualified ID have a reference ACK Response.pub fn receive_wire_response(    &mut self,    channel: &Channel,    entry: Entry,    bytes: &[u8],    credentials: &WireCredentials<'_, S>,    delivery: DeliveryWindow,) -> Result<Vec<u8>, WireError> {    #[cfg(test)] let _source_scope=source_trace::begin(bytes);    let (original, id) = self.response_original(channel, bytes)?;    let security = self.security.clone();    let signer = security.response_signer().ok_or(WireError::InvalidSource)?;    let outcome =        match self.receive_wire_result(channel, entry, bytes, credentials, delivery, true) {            Ok((received, retained)) => {                #[cfg(test)] source_trace::received(&received,retained);                ResponseResult::from_received(received, retained)            },            Err(error) => {                #[cfg(test)] source_trace::wire_error(&error);                ResponseResult::error(error)            },        };    encode_response(        channel,        signer,        &original,        id,        outcome,        security.frame_limit(channel),    )}

fn caller_id(operands: &Operands) -> Result<CallId, WireError> {    match operands {        Operands::Ordinary { id, .. } | Operands::Legal { id, .. } | Operands::Spend { id, .. } => {            Ok(*id)        }        _ => Err(BAD),    }}

{  "id": "query-1-same",  "expected_kind": "query",  "query_opcode": 1,  "query_words": [    2,    0,    1,    17  ],  "embedded": "same",  "response_words": [    7,    33,    3,    70,    0  ],  "expect_error": 70,  "expect_unknown": null},{  "id": "query-1-mismatch",  "expected_kind": "query",  "query_opcode": 1,  "query_words": [    2,    0,    1,    17  ],  "embedded": "debit",  "response_words": [    7,    33,    3,    70,    0  ],  "expect_error": 76,  "expect_unknown": null},

{  "id": "query-8-mismatch",  "expected_kind": "query",  "query_opcode": 8,  "query_words": [    2  ],  "embedded": "debit",  "response_words": [    7,    33,    3,    70,    0  ],  "expect_error": 70,  "expect_unknown": null},

/// The category that the kind word of a response names.#[derive(Clone, Copy, Debug, Eq, PartialEq)]pub enum ResponseKind {    /// The exact product outcome retained for the original call.    Recorded = 1,    /// A delivery status. It does not establish the outcome of the call.    Delivery = 2,    /// A refusal of the original frame.    Refusal = 3,}