security.vdl.go

// Copyright 2015 The Vanadium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This file was auto-generated by the vanadium vdl tool.
// Package: security
//
//nolint:revive
package security

import (
	"fmt"
	"time"

	"v.io/v23/context"
	"v.io/v23/uniqueid"
	"v.io/v23/vdl"
	vdltime "v.io/v23/vdlroot/time"
	"v.io/v23/verror"
	"v.io/v23/vom"
)

var initializeVDLCalled = false
var _ = initializeVDL() // Must be first; see initializeVDL comments for details.

// Hold type definitions in package-level variables, for better performance.
// Declare and initialize with default values here so that the initializeVDL
// method will be considered ready to initialize before any of the type
// definitions that appear below.
//
//nolint:unused
var (
	vdlTypeArray1   *vdl.Type = nil
	vdlTypeStruct2  *vdl.Type = nil
	vdlTypeArray3   *vdl.Type = nil
	vdlTypeList4    *vdl.Type = nil
	vdlTypeStruct5  *vdl.Type = nil
	vdlTypeStruct6  *vdl.Type = nil
	vdlTypeList7    *vdl.Type = nil
	vdlTypeString8  *vdl.Type = nil
	vdlTypeStruct9  *vdl.Type = nil
	vdlTypeStruct10 *vdl.Type = nil
	vdlTypeString11 *vdl.Type = nil
	vdlTypeStruct12 *vdl.Type = nil
	vdlTypeStruct13 *vdl.Type = nil
	vdlTypeList14   *vdl.Type = nil
	vdlTypeList15   *vdl.Type = nil
	vdlTypeStruct16 *vdl.Type = nil
	vdlTypeStruct17 *vdl.Type = nil
	vdlTypeStruct18 *vdl.Type = nil
	vdlTypeList19   *vdl.Type = nil
	vdlTypeList20   *vdl.Type = nil
	vdlTypeUnion21  *vdl.Type = nil
	vdlTypeStruct22 *vdl.Type = nil
)

// Type definitions
// ================
type nonce [16]byte

func (nonce) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.nonce"`
}) {
}

func (x nonce) VDLIsZero() bool { //nolint:gocyclo
	return x == nonce{}
}

func (x nonce) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.WriteValueBytes(vdlTypeArray1, x[:]); err != nil {
		return err
	}
	return nil
}

func (x *nonce) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	bytes := x[:]
	if err := dec.ReadValueBytes(16, &bytes); err != nil {
		return err
	}
	return nil
}

// Caveat is a condition on the validity of a blessing/discharge.
//
// These conditions are provided when asking a principal to create
// a blessing/discharge and are verified when extracting blessings
// (Blessings.ForName in the Go API).
//
// Given a Hash, the message digest of a caveat is:
// Hash(Hash(Id), Hash(ParamVom))
type Caveat struct {
	Id       uniqueid.Id // The identifier of the caveat validation function.
	ParamVom []byte      // VOM-encoded bytes of the parameters to be provided to the validation function.
}

func (Caveat) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.Caveat"`
}) {
}

func (x Caveat) VDLIsZero() bool { //nolint:gocyclo
	if x.Id != (uniqueid.Id{}) {
		return false
	}
	if len(x.ParamVom) != 0 {
		return false
	}
	return true
}

func (x Caveat) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct2); err != nil {
		return err
	}
	if x.Id != (uniqueid.Id{}) {
		if err := enc.NextFieldValueBytes(0, vdlTypeArray3, x.Id[:]); err != nil {
			return err
		}
	}
	if len(x.ParamVom) != 0 {
		if err := enc.NextFieldValueBytes(1, vdlTypeList4, x.ParamVom); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *Caveat) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = Caveat{}
	if err := dec.StartValue(vdlTypeStruct2); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct2 {
			index = vdlTypeStruct2.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			bytes := x.Id[:]
			if err := dec.ReadValueBytes(16, &bytes); err != nil {
				return err
			}
		case 1:
			if err := dec.ReadValueBytes(-1, &x.ParamVom); err != nil {
				return err
			}
		}
	}
}

// ThirdPartyRequirements specifies the information required by the third-party
// that will issue discharges for third-party caveats.
//
// These requirements are typically used to construct a DischargeImpetus, which
// will be sent to the third-party.
type ThirdPartyRequirements struct {
	ReportServer    bool // The blessings presented by the server of an IPC call.
	ReportMethod    bool // The name of the method being invoked.
	ReportArguments bool // Arguments to the method being invoked.
}

func (ThirdPartyRequirements) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.ThirdPartyRequirements"`
}) {
}

func (x ThirdPartyRequirements) VDLIsZero() bool { //nolint:gocyclo
	return x == ThirdPartyRequirements{}
}

func (x ThirdPartyRequirements) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct5); err != nil {
		return err
	}
	if x.ReportServer {
		if err := enc.NextFieldValueBool(0, vdl.BoolType, x.ReportServer); err != nil {
			return err
		}
	}
	if x.ReportMethod {
		if err := enc.NextFieldValueBool(1, vdl.BoolType, x.ReportMethod); err != nil {
			return err
		}
	}
	if x.ReportArguments {
		if err := enc.NextFieldValueBool(2, vdl.BoolType, x.ReportArguments); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *ThirdPartyRequirements) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = ThirdPartyRequirements{}
	if err := dec.StartValue(vdlTypeStruct5); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct5 {
			index = vdlTypeStruct5.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			switch value, err := dec.ReadValueBool(); {
			case err != nil:
				return err
			default:
				x.ReportServer = value
			}
		case 1:
			switch value, err := dec.ReadValueBool(); {
			case err != nil:
				return err
			default:
				x.ReportMethod = value
			}
		case 2:
			switch value, err := dec.ReadValueBool(); {
			case err != nil:
				return err
			default:
				x.ReportArguments = value
			}
		}
	}
}

// publicKeyThirdPartyCaveatParam represents a third-party caveat that requires
// PublicKeyDischarge(s) to be issued by a principal identified by a public key.
//
// The Id of the caveat is base64-encoded:
// hash(hash(Nonce), hash(DischargerKey), hash(Caveats[0]), hash(Caveats[1]), ...)
// where hash is a cryptographic hash function with a security strength
// equivalent to that of the DischargerKey. For example, if DischargerKey
// represents an ECDSA public key with the P384 curve, then hash should be
// SHA384.
type publicKeyThirdPartyCaveatParam struct {
	// Nonce specifies a cryptographically random nonce associated with an
	// instance of the caveat. This prevents discharge replays, where
	// discharges for ThirdPartyCaveats embedded in the certificates for
	// one blessing can be used for another blessing.
	//
	// Whether discharge re-use is a desired or un-desired property is
	// still under debate. Till the debate is settled, we err on the side
	// of discouraging re-use.
	Nonce nonce
	// Caveats specifies the caveats that have to be validated
	// before minting a discharge for a publicKeyCaveat.
	Caveats []Caveat
	// DER-encoded PKIX public key of the principal that can issue discharges.
	DischargerKey []byte
	// Object name where the third-party that can issue discharges can be found.
	DischargerLocation string
	// Information required by the third-party in order to issue a discharge.
	DischargerRequirements ThirdPartyRequirements
}

func (publicKeyThirdPartyCaveatParam) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.publicKeyThirdPartyCaveatParam"`
}) {
}

func (x publicKeyThirdPartyCaveatParam) VDLIsZero() bool { //nolint:gocyclo
	if x.Nonce != (nonce{}) {
		return false
	}
	if len(x.Caveats) != 0 {
		return false
	}
	if len(x.DischargerKey) != 0 {
		return false
	}
	if x.DischargerLocation != "" {
		return false
	}
	if x.DischargerRequirements != (ThirdPartyRequirements{}) {
		return false
	}
	return true
}

func (x publicKeyThirdPartyCaveatParam) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct6); err != nil {
		return err
	}
	if x.Nonce != (nonce{}) {
		if err := enc.NextFieldValueBytes(0, vdlTypeArray1, x.Nonce[:]); err != nil {
			return err
		}
	}
	if len(x.Caveats) != 0 {
		if err := enc.NextField(1); err != nil {
			return err
		}
		if err := vdlWriteAnonList1(enc, x.Caveats); err != nil {
			return err
		}
	}
	if len(x.DischargerKey) != 0 {
		if err := enc.NextFieldValueBytes(2, vdlTypeList4, x.DischargerKey); err != nil {
			return err
		}
	}
	if x.DischargerLocation != "" {
		if err := enc.NextFieldValueString(3, vdl.StringType, x.DischargerLocation); err != nil {
			return err
		}
	}
	if x.DischargerRequirements != (ThirdPartyRequirements{}) {
		if err := enc.NextField(4); err != nil {
			return err
		}
		if err := x.DischargerRequirements.VDLWrite(enc); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func vdlWriteAnonList1(enc vdl.Encoder, x []Caveat) error {
	if err := enc.StartValue(vdlTypeList7); err != nil {
		return err
	}
	if err := enc.SetLenHint(len(x)); err != nil {
		return err
	}
	for _, elem := range x {
		if err := enc.NextEntry(false); err != nil {
			return err
		}
		if err := elem.VDLWrite(enc); err != nil {
			return err
		}
	}
	if err := enc.NextEntry(true); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *publicKeyThirdPartyCaveatParam) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = publicKeyThirdPartyCaveatParam{}
	if err := dec.StartValue(vdlTypeStruct6); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct6 {
			index = vdlTypeStruct6.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			bytes := x.Nonce[:]
			if err := dec.ReadValueBytes(16, &bytes); err != nil {
				return err
			}
		case 1:
			if err := vdlReadAnonList1(dec, &x.Caveats); err != nil {
				return err
			}
		case 2:
			if err := dec.ReadValueBytes(-1, &x.DischargerKey); err != nil {
				return err
			}
		case 3:
			switch value, err := dec.ReadValueString(); {
			case err != nil:
				return err
			default:
				x.DischargerLocation = value
			}
		case 4:
			if err := x.DischargerRequirements.VDLRead(dec); err != nil {
				return err
			}
		}
	}
}

func vdlReadAnonList1(dec vdl.Decoder, x *[]Caveat) error {
	if err := dec.StartValue(vdlTypeList7); err != nil {
		return err
	}
	if len := dec.LenHint(); len > 0 {
		*x = make([]Caveat, 0, len)
	} else {
		*x = nil
	}
	for {
		switch done, err := dec.NextEntry(); {
		case err != nil:
			return err
		case done:
			return dec.FinishValue()
		default:
			var elem Caveat
			if err := elem.VDLRead(dec); err != nil {
				return err
			}
			*x = append(*x, elem)
		}
	}
}

// Hash identifies a cryptographic hash function approved for use in signature algorithms.
type Hash string

func (Hash) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.Hash"`
}) {
}

func (x Hash) VDLIsZero() bool { //nolint:gocyclo
	return x == ""
}

func (x Hash) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.WriteValueString(vdlTypeString8, string(x)); err != nil {
		return err
	}
	return nil
}

func (x *Hash) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	switch value, err := dec.ReadValueString(); {
	case err != nil:
		return err
	default:
		*x = Hash(value)
	}
	return nil
}

// Signature represents a digital signature.
type Signature struct {
	// Purpose of the signature. Can be used to prevent type attacks.
	// (See Section 4.2 of http://www-users.cs.york.ac.uk/~jac/PublishedPapers/reviewV1_1997.pdf for example).
	// The actual signature (R, S values for ECDSA keys, byte slice for ED25519) is produced by signing: Hash(Hash(message), Hash(Purpose)).
	Purpose []byte
	// Cryptographic hash function applied to the message before computing the signature.
	Hash Hash
	// Pair of integers that make up an ECDSA signature, it will be nil otherwise.
	R []byte
	S []byte
	// Ed25519 contains an ed25519 signature, it will be nil otherwise.
	Ed25519 []byte
	// RSA contains an RSA signature, it will be nil otherewise.
	Rsa []byte
}

func (Signature) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.Signature"`
}) {
}

func (x Signature) VDLIsZero() bool { //nolint:gocyclo
	if len(x.Purpose) != 0 {
		return false
	}
	if x.Hash != "" {
		return false
	}
	if len(x.R) != 0 {
		return false
	}
	if len(x.S) != 0 {
		return false
	}
	if len(x.Ed25519) != 0 {
		return false
	}
	if len(x.Rsa) != 0 {
		return false
	}
	return true
}

func (x Signature) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct9); err != nil {
		return err
	}
	if len(x.Purpose) != 0 {
		if err := enc.NextFieldValueBytes(0, vdlTypeList4, x.Purpose); err != nil {
			return err
		}
	}
	if x.Hash != "" {
		if err := enc.NextFieldValueString(1, vdlTypeString8, string(x.Hash)); err != nil {
			return err
		}
	}
	if len(x.R) != 0 {
		if err := enc.NextFieldValueBytes(2, vdlTypeList4, x.R); err != nil {
			return err
		}
	}
	if len(x.S) != 0 {
		if err := enc.NextFieldValueBytes(3, vdlTypeList4, x.S); err != nil {
			return err
		}
	}
	if len(x.Ed25519) != 0 {
		if err := enc.NextFieldValueBytes(4, vdlTypeList4, x.Ed25519); err != nil {
			return err
		}
	}
	if len(x.Rsa) != 0 {
		if err := enc.NextFieldValueBytes(5, vdlTypeList4, x.Rsa); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *Signature) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = Signature{}
	if err := dec.StartValue(vdlTypeStruct9); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct9 {
			index = vdlTypeStruct9.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			if err := dec.ReadValueBytes(-1, &x.Purpose); err != nil {
				return err
			}
		case 1:
			switch value, err := dec.ReadValueString(); {
			case err != nil:
				return err
			default:
				x.Hash = Hash(value)
			}
		case 2:
			if err := dec.ReadValueBytes(-1, &x.R); err != nil {
				return err
			}
		case 3:
			if err := dec.ReadValueBytes(-1, &x.S); err != nil {
				return err
			}
		case 4:
			if err := dec.ReadValueBytes(-1, &x.Ed25519); err != nil {
				return err
			}
		case 5:
			if err := dec.ReadValueBytes(-1, &x.Rsa); err != nil {
				return err
			}
		}
	}
}

// PublicKeyDischarge represents a discharge for third party caveats that
// require a signature from a third-party's public key.
//
// The message digest of this structure is computed as follows:
// hash(hash(ThirdPartyCaveatId), hash(Caveats[0]), hash(Caveats[1]), ...),
// where hash is a cryptographic hash function with a security strength
// equivalent to the strength of the public key of the principal issuing the
// discharge.
type PublicKeyDischarge struct {
	ThirdPartyCaveatId string    // Id of the third party caveat for which this discharge was issued.
	Caveats            []Caveat  // Caveats on the use of this discharge.
	Signature          Signature // Signature of the content hash of this discharge by the discharger.
}

func (PublicKeyDischarge) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.PublicKeyDischarge"`
}) {
}

func (x PublicKeyDischarge) VDLIsZero() bool { //nolint:gocyclo
	if x.ThirdPartyCaveatId != "" {
		return false
	}
	if len(x.Caveats) != 0 {
		return false
	}
	if !x.Signature.VDLIsZero() {
		return false
	}
	return true
}

func (x PublicKeyDischarge) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct10); err != nil {
		return err
	}
	if x.ThirdPartyCaveatId != "" {
		if err := enc.NextFieldValueString(0, vdl.StringType, x.ThirdPartyCaveatId); err != nil {
			return err
		}
	}
	if len(x.Caveats) != 0 {
		if err := enc.NextField(1); err != nil {
			return err
		}
		if err := vdlWriteAnonList1(enc, x.Caveats); err != nil {
			return err
		}
	}
	if !x.Signature.VDLIsZero() {
		if err := enc.NextField(2); err != nil {
			return err
		}
		if err := x.Signature.VDLWrite(enc); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *PublicKeyDischarge) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = PublicKeyDischarge{}
	if err := dec.StartValue(vdlTypeStruct10); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct10 {
			index = vdlTypeStruct10.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			switch value, err := dec.ReadValueString(); {
			case err != nil:
				return err
			default:
				x.ThirdPartyCaveatId = value
			}
		case 1:
			if err := vdlReadAnonList1(dec, &x.Caveats); err != nil {
				return err
			}
		case 2:
			if err := x.Signature.VDLRead(dec); err != nil {
				return err
			}
		}
	}
}

// BlessingPattern is a pattern that is matched by specific blessings.
//
// A pattern can either be a blessing (colon-separated human-readable string, as
// defined by ChainSeparator), or a blessing ending in ":$". A pattern ending
// in ":$" is matched exactly by the blessing specified by the pattern string
// with the ":$" suffix stripped out. For example, the pattern "a:b:c:$" is
// matched by exactly by the blessing "a:b:c".
//
// A pattern not ending in ":$" is more permissive, and is also matched by blessings
// that are extensions of the pattern (including the pattern itself). For example, the
// pattern "a:b:c" is matched by the blessings "a:b:c", "a:b:c:x", "a:b:c:x:y", etc.
//
// TODO(ataly, ashankar): Define a formal BNF grammar for blessings and blessing patterns.
type BlessingPattern string

func (BlessingPattern) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.BlessingPattern"`
}) {
}

func (x BlessingPattern) VDLIsZero() bool { //nolint:gocyclo
	return x == ""
}

func (x BlessingPattern) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.WriteValueString(vdlTypeString11, string(x)); err != nil {
		return err
	}
	return nil
}

func (x *BlessingPattern) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	switch value, err := dec.ReadValueString(); {
	case err != nil:
		return err
	default:
		*x = BlessingPattern(value)
	}
	return nil
}

// EcdsaOnlySignature represents a digital signature for ecdsa only. It is
// defined purely for testing purposes to ensure that instances of services
// created before the addition of ED25519 support can interoperat with ones
// that do support ED25519.
type EcdsaOnlySignature struct {
	Purpose []byte
	Hash    Hash
	R       []byte
	S       []byte
}

func (EcdsaOnlySignature) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.EcdsaOnlySignature"`
}) {
}

func (x EcdsaOnlySignature) VDLIsZero() bool { //nolint:gocyclo
	if len(x.Purpose) != 0 {
		return false
	}
	if x.Hash != "" {
		return false
	}
	if len(x.R) != 0 {
		return false
	}
	if len(x.S) != 0 {
		return false
	}
	return true
}

func (x EcdsaOnlySignature) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct12); err != nil {
		return err
	}
	if len(x.Purpose) != 0 {
		if err := enc.NextFieldValueBytes(0, vdlTypeList4, x.Purpose); err != nil {
			return err
		}
	}
	if x.Hash != "" {
		if err := enc.NextFieldValueString(1, vdlTypeString8, string(x.Hash)); err != nil {
			return err
		}
	}
	if len(x.R) != 0 {
		if err := enc.NextFieldValueBytes(2, vdlTypeList4, x.R); err != nil {
			return err
		}
	}
	if len(x.S) != 0 {
		if err := enc.NextFieldValueBytes(3, vdlTypeList4, x.S); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *EcdsaOnlySignature) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = EcdsaOnlySignature{}
	if err := dec.StartValue(vdlTypeStruct12); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct12 {
			index = vdlTypeStruct12.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			if err := dec.ReadValueBytes(-1, &x.Purpose); err != nil {
				return err
			}
		case 1:
			switch value, err := dec.ReadValueString(); {
			case err != nil:
				return err
			default:
				x.Hash = Hash(value)
			}
		case 2:
			if err := dec.ReadValueBytes(-1, &x.R); err != nil {
				return err
			}
		case 3:
			if err := dec.ReadValueBytes(-1, &x.S); err != nil {
				return err
			}
		}
	}
}

// DischargeImpetus encapsulates the motivation for a discharge being sought.
//
// These values are reported by a principal that is requesting a Discharge for
// a third-party caveat on one of its blessings. The third-party issues
// discharges cannot safely assume that all these values are provided, or that
// they are provided honestly.
//
// Implementations of services that issue discharges are encouraged to add
// caveats to the discharge that bind the discharge to the impetus, thereby
// rendering the discharge unusable for any other purpose.
type DischargeImpetus struct {
	Server    []BlessingPattern // The client intends to use the discharge to communicate with a server that has a blessing matching one of the patterns in this set.
	Method    string            // Name of the method being invoked by the client.
	Arguments []*vom.RawBytes   // Arguments to the method invocation.
}

func (DischargeImpetus) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.DischargeImpetus"`
}) {
}

func (x DischargeImpetus) VDLIsZero() bool { //nolint:gocyclo
	if len(x.Server) != 0 {
		return false
	}
	if x.Method != "" {
		return false
	}
	if len(x.Arguments) != 0 {
		return false
	}
	return true
}

func (x DischargeImpetus) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct13); err != nil {
		return err
	}
	if len(x.Server) != 0 {
		if err := enc.NextField(0); err != nil {
			return err
		}
		if err := vdlWriteAnonList2(enc, x.Server); err != nil {
			return err
		}
	}
	if x.Method != "" {
		if err := enc.NextFieldValueString(1, vdl.StringType, x.Method); err != nil {
			return err
		}
	}
	if len(x.Arguments) != 0 {
		if err := enc.NextField(2); err != nil {
			return err
		}
		if err := vdlWriteAnonList3(enc, x.Arguments); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func vdlWriteAnonList2(enc vdl.Encoder, x []BlessingPattern) error {
	if err := enc.StartValue(vdlTypeList14); err != nil {
		return err
	}
	if err := enc.SetLenHint(len(x)); err != nil {
		return err
	}
	for _, elem := range x {
		if err := enc.NextEntryValueString(vdlTypeString11, string(elem)); err != nil {
			return err
		}
	}
	if err := enc.NextEntry(true); err != nil {
		return err
	}
	return enc.FinishValue()
}

func vdlWriteAnonList3(enc vdl.Encoder, x []*vom.RawBytes) error {
	if err := enc.StartValue(vdlTypeList15); err != nil {
		return err
	}
	if err := enc.SetLenHint(len(x)); err != nil {
		return err
	}
	for _, elem := range x {
		if err := enc.NextEntry(false); err != nil {
			return err
		}
		if elem == nil {
			if err := enc.NilValue(vdl.AnyType); err != nil {
				return err
			}
		} else {
			if err := elem.VDLWrite(enc); err != nil {
				return err
			}
		}
	}
	if err := enc.NextEntry(true); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *DischargeImpetus) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = DischargeImpetus{}
	if err := dec.StartValue(vdlTypeStruct13); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct13 {
			index = vdlTypeStruct13.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			if err := vdlReadAnonList2(dec, &x.Server); err != nil {
				return err
			}
		case 1:
			switch value, err := dec.ReadValueString(); {
			case err != nil:
				return err
			default:
				x.Method = value
			}
		case 2:
			if err := vdlReadAnonList3(dec, &x.Arguments); err != nil {
				return err
			}
		}
	}
}

func vdlReadAnonList2(dec vdl.Decoder, x *[]BlessingPattern) error {
	if err := dec.StartValue(vdlTypeList14); err != nil {
		return err
	}
	if len := dec.LenHint(); len > 0 {
		*x = make([]BlessingPattern, 0, len)
	} else {
		*x = nil
	}
	for {
		switch done, elem, err := dec.NextEntryValueString(); {
		case err != nil:
			return err
		case done:
			return dec.FinishValue()
		default:
			*x = append(*x, BlessingPattern(elem))
		}
	}
}

func vdlReadAnonList3(dec vdl.Decoder, x *[]*vom.RawBytes) error {
	if err := dec.StartValue(vdlTypeList15); err != nil {
		return err
	}
	if len := dec.LenHint(); len > 0 {
		*x = make([]*vom.RawBytes, 0, len)
	} else {
		*x = nil
	}
	for {
		switch done, err := dec.NextEntry(); {
		case err != nil:
			return err
		case done:
			return dec.FinishValue()
		default:
			var elem *vom.RawBytes
			elem = new(vom.RawBytes)
			if err := elem.VDLRead(dec); err != nil {
				return err
			}
			*x = append(*x, elem)
		}
	}
}

// Certificate represents the cryptographic proof of the binding of
// extensions of a blessing held by one principal to another (represented by
// a public key) under specific caveats.
//
// For example, if a principal P1 has a blessing "alice", then it can
// extend it with a Certificate to generate the blessing "alice/friend" for
// another principal P2.
//
// X509 Certificates may be embedded in a Certificate to allow for principals
// to be authenticated based on SSL/TLS Root Certificate Authorities. The
// X509 Certificate will be included in the digents used to generate the
// signature for the certificate.
type Certificate struct {
	Extension string    // Human-readable string extension bound to PublicKey.
	PublicKey []byte    // DER-encoded PKIX public key.
	Caveats   []Caveat  // Caveats on the binding of Name to PublicKey.
	X509Raw   []byte    // Complete ASN.1 DER content (eg. from x509.Certificate.Raw)
	Signature Signature // Signature by the blessing principal that binds the extension to the public key.
}

func (Certificate) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.Certificate"`
}) {
}

func (x Certificate) VDLIsZero() bool { //nolint:gocyclo
	if x.Extension != "" {
		return false
	}
	if len(x.PublicKey) != 0 {
		return false
	}
	if len(x.Caveats) != 0 {
		return false
	}
	if len(x.X509Raw) != 0 {
		return false
	}
	if !x.Signature.VDLIsZero() {
		return false
	}
	return true
}

func (x Certificate) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct16); err != nil {
		return err
	}
	if x.Extension != "" {
		if err := enc.NextFieldValueString(0, vdl.StringType, x.Extension); err != nil {
			return err
		}
	}
	if len(x.PublicKey) != 0 {
		if err := enc.NextFieldValueBytes(1, vdlTypeList4, x.PublicKey); err != nil {
			return err
		}
	}
	if len(x.Caveats) != 0 {
		if err := enc.NextField(2); err != nil {
			return err
		}
		if err := vdlWriteAnonList1(enc, x.Caveats); err != nil {
			return err
		}
	}
	if len(x.X509Raw) != 0 {
		if err := enc.NextFieldValueBytes(3, vdlTypeList4, x.X509Raw); err != nil {
			return err
		}
	}
	if !x.Signature.VDLIsZero() {
		if err := enc.NextField(4); err != nil {
			return err
		}
		if err := x.Signature.VDLWrite(enc); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *Certificate) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = Certificate{}
	if err := dec.StartValue(vdlTypeStruct16); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct16 {
			index = vdlTypeStruct16.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			switch value, err := dec.ReadValueString(); {
			case err != nil:
				return err
			default:
				x.Extension = value
			}
		case 1:
			if err := dec.ReadValueBytes(-1, &x.PublicKey); err != nil {
				return err
			}
		case 2:
			if err := vdlReadAnonList1(dec, &x.Caveats); err != nil {
				return err
			}
		case 3:
			if err := dec.ReadValueBytes(-1, &x.X509Raw); err != nil {
				return err
			}
		case 4:
			if err := x.Signature.VDLRead(dec); err != nil {
				return err
			}
		}
	}
}

// CaveatDescriptor defines an association between a caveat validation function
// (addressed by globally unique identifier) and the data needed by the
// validation function.
//
// For a validator to be invoked, a validation function must be registered with
// the validator description in the language that the function is defined in.
type CaveatDescriptor struct {
	Id        uniqueid.Id // The identifier of the caveat validation function.
	ParamType *vdl.Type   // The type of the parameter expected by the validation function.
}

func (CaveatDescriptor) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.CaveatDescriptor"`
}) {
}

func (x CaveatDescriptor) VDLIsZero() bool { //nolint:gocyclo
	if x.Id != (uniqueid.Id{}) {
		return false
	}
	if x.ParamType != nil && x.ParamType != vdl.AnyType {
		return false
	}
	return true
}

func (x CaveatDescriptor) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct17); err != nil {
		return err
	}
	if x.Id != (uniqueid.Id{}) {
		if err := enc.NextFieldValueBytes(0, vdlTypeArray3, x.Id[:]); err != nil {
			return err
		}
	}
	if x.ParamType != nil && x.ParamType != vdl.AnyType {
		if err := enc.NextFieldValueTypeObject(1, x.ParamType); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *CaveatDescriptor) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = CaveatDescriptor{
		ParamType: vdl.AnyType,
	}
	if err := dec.StartValue(vdlTypeStruct17); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct17 {
			index = vdlTypeStruct17.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			bytes := x.Id[:]
			if err := dec.ReadValueBytes(16, &bytes); err != nil {
				return err
			}
		case 1:
			switch value, err := dec.ReadValueTypeObject(); {
			case err != nil:
				return err
			default:
				x.ParamType = value
			}
		}
	}
}

// WireBlessings encapsulates wire format of a set of blessings and the
// corresponding cryptographic proof that binds them to a principal
// (identified by a public key).
//
// This structure is the "wire" format for sending and receiving blessings
// in RPCs or marshaling to persistent storage. Typically, languages will
// provide a factory function that converts this wire representation to
// a more usable object to inspect and manipulate these blessings.
type WireBlessings struct {
	// CertificateChains is an array of chains of certificates that bind
	// a blessing to the public key in the last certificate of the chain.
	CertificateChains [][]Certificate
}

func (WireBlessings) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.WireBlessings"`
}) {
}

func (x WireBlessings) VDLIsZero() bool { //nolint:gocyclo
	return len(x.CertificateChains) == 0
}

func (x WireBlessings) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct18); err != nil {
		return err
	}
	if len(x.CertificateChains) != 0 {
		if err := enc.NextField(0); err != nil {
			return err
		}
		if err := vdlWriteAnonList4(enc, x.CertificateChains); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func vdlWriteAnonList4(enc vdl.Encoder, x [][]Certificate) error {
	if err := enc.StartValue(vdlTypeList19); err != nil {
		return err
	}
	if err := enc.SetLenHint(len(x)); err != nil {
		return err
	}
	for _, elem := range x {
		if err := enc.NextEntry(false); err != nil {
			return err
		}
		if err := vdlWriteAnonList5(enc, elem); err != nil {
			return err
		}
	}
	if err := enc.NextEntry(true); err != nil {
		return err
	}
	return enc.FinishValue()
}

func vdlWriteAnonList5(enc vdl.Encoder, x []Certificate) error {
	if err := enc.StartValue(vdlTypeList20); err != nil {
		return err
	}
	if err := enc.SetLenHint(len(x)); err != nil {
		return err
	}
	for _, elem := range x {
		if err := enc.NextEntry(false); err != nil {
			return err
		}
		if err := elem.VDLWrite(enc); err != nil {
			return err
		}
	}
	if err := enc.NextEntry(true); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *WireBlessings) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = WireBlessings{}
	if err := dec.StartValue(vdlTypeStruct18); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct18 {
			index = vdlTypeStruct18.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		if index == 0 {

			if err := vdlReadAnonList4(dec, &x.CertificateChains); err != nil {
				return err
			}
		}
	}
}

func vdlReadAnonList4(dec vdl.Decoder, x *[][]Certificate) error {
	if err := dec.StartValue(vdlTypeList19); err != nil {
		return err
	}
	if len := dec.LenHint(); len > 0 {
		*x = make([][]Certificate, 0, len)
	} else {
		*x = nil
	}
	for {
		switch done, err := dec.NextEntry(); {
		case err != nil:
			return err
		case done:
			return dec.FinishValue()
		default:
			var elem []Certificate
			if err := vdlReadAnonList5(dec, &elem); err != nil {
				return err
			}
			*x = append(*x, elem)
		}
	}
}

func vdlReadAnonList5(dec vdl.Decoder, x *[]Certificate) error {
	if err := dec.StartValue(vdlTypeList20); err != nil {
		return err
	}
	if len := dec.LenHint(); len > 0 {
		*x = make([]Certificate, 0, len)
	} else {
		*x = nil
	}
	for {
		switch done, err := dec.NextEntry(); {
		case err != nil:
			return err
		case done:
			return dec.FinishValue()
		default:
			var elem Certificate
			if err := elem.VDLRead(dec); err != nil {
				return err
			}
			*x = append(*x, elem)
		}
	}
}

type (
	// WireDischarge represents any single field of the WireDischarge union type.
	//
	// WireDischarge encapsulates the wire format of a third-party caveat
	// Discharge.
	WireDischarge interface {
		// Index returns the field index.
		Index() int
		// Interface returns the field value as an interface.
		Interface() interface{}
		// Name returns the field name.
		Name() string
		// VDLReflect describes the WireDischarge union type.
		VDLReflect(vdlWireDischargeReflect)
		VDLIsZero() bool
		VDLWrite(vdl.Encoder) error
	}
	// WireDischargePublicKey represents field PublicKey of the WireDischarge union type.
	WireDischargePublicKey struct{ Value PublicKeyDischarge } // Discharge for PublicKeyThirdPartyCaveat
	// vdlWireDischargeReflect describes the WireDischarge union type.
	vdlWireDischargeReflect struct {
		Name  string `vdl:"v.io/v23/security.WireDischarge"`
		Type  WireDischarge
		Union struct {
			PublicKey WireDischargePublicKey
		}
	}
)

func (x WireDischargePublicKey) Index() int                         { return 0 }
func (x WireDischargePublicKey) Interface() interface{}             { return x.Value }
func (x WireDischargePublicKey) Name() string                       { return "PublicKey" }
func (x WireDischargePublicKey) VDLReflect(vdlWireDischargeReflect) {}

func (x WireDischargePublicKey) VDLIsZero() bool { //nolint:gocyclo
	return x.Value.VDLIsZero()
}

func (x WireDischargePublicKey) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeUnion21); err != nil {
		return err
	}
	if err := enc.NextField(0); err != nil {
		return err
	}
	if err := x.Value.VDLWrite(enc); err != nil {
		return err
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func VDLReadWireDischarge(dec vdl.Decoder, x *WireDischarge) error { //nolint:gocyclo
	if err := dec.StartValue(vdlTypeUnion21); err != nil {
		return err
	}
	decType := dec.Type()
	index, err := dec.NextField()
	switch {
	case err != nil:
		return err
	case index == -1:
		return fmt.Errorf("missing field in union %T, from %v", x, decType)
	}
	if decType != vdlTypeUnion21 {
		name := decType.Field(index).Name
		index = vdlTypeUnion21.FieldIndexByName(name)
		if index == -1 {
			return fmt.Errorf("field %q not in union %T, from %v", name, x, decType)
		}
	}
	if index == 0 {
		var field WireDischargePublicKey
		if err := field.Value.VDLRead(dec); err != nil {
			return err
		}
		*x = field
	}
	return dec.FinishValue()
}

// RejectedBlessing describes why a blessing failed validation.
type RejectedBlessing struct {
	Blessing string
	Err      error
}

func (RejectedBlessing) VDLReflect(struct {
	Name string `vdl:"v.io/v23/security.RejectedBlessing"`
}) {
}

func (x RejectedBlessing) VDLIsZero() bool { //nolint:gocyclo
	return x == RejectedBlessing{}
}

func (x RejectedBlessing) VDLWrite(enc vdl.Encoder) error { //nolint:gocyclo
	if err := enc.StartValue(vdlTypeStruct22); err != nil {
		return err
	}
	if x.Blessing != "" {
		if err := enc.NextFieldValueString(0, vdl.StringType, x.Blessing); err != nil {
			return err
		}
	}
	if x.Err != nil {
		if err := enc.NextField(1); err != nil {
			return err
		}
		if err := verror.VDLWrite(enc, x.Err); err != nil {
			return err
		}
	}
	if err := enc.NextField(-1); err != nil {
		return err
	}
	return enc.FinishValue()
}

func (x *RejectedBlessing) VDLRead(dec vdl.Decoder) error { //nolint:gocyclo
	*x = RejectedBlessing{}
	if err := dec.StartValue(vdlTypeStruct22); err != nil {
		return err
	}
	decType := dec.Type()
	for {
		index, err := dec.NextField()
		switch {
		case err != nil:
			return err
		case index == -1:
			return dec.FinishValue()
		}
		if decType != vdlTypeStruct22 {
			index = vdlTypeStruct22.FieldIndexByName(decType.Field(index).Name)
			if index == -1 {
				if err := dec.SkipValue(); err != nil {
					return err
				}
				continue
			}
		}
		switch index {
		case 0:
			switch value, err := dec.ReadValueString(); {
			case err != nil:
				return err
			default:
				x.Blessing = value
			}
		case 1:
			if err := verror.VDLRead(dec, &x.Err); err != nil {
				return err
			}
		}
	}
}

// Type-check native conversion functions.
var (
	_ func(WireBlessings, *Blessings) error = WireBlessingsToNative
	_ func(*WireBlessings, Blessings) error = WireBlessingsFromNative
	_ func(WireDischarge, *Discharge) error = WireDischargeToNative
	_ func(*WireDischarge, Discharge) error = WireDischargeFromNative
)

// Const definitions
// =================

// ConstCaveat represents a caveat that either always validates or never validates.
var ConstCaveat = CaveatDescriptor{
	ParamType: vdl.BoolType,
}

// ExpiryCaveat represents a caveat that validates iff the current time is no later
// the specified time.Time.
var ExpiryCaveat = CaveatDescriptor{
	Id: uniqueid.Id{
		166,
		76,
		45,
		1,
		25,
		251,
		163,
		52,
		128,
		113,
		254,
		235,
		47,
		48,
		128,
		0,
	},
	ParamType: vdl.TypeOf((*vdltime.Time)(nil)).Elem(),
}

// NotBeforeCaveat represents a caveat that validates iff the current time is
// not before the specified time.Time.
var NotBeforeCaveat = CaveatDescriptor{
	Id: uniqueid.Id{
		186,
		175,
		104,
		57,
		169,
		143,
		156,
		19,
		131,
		153,
		205,
		105,
		214,
		255,
		153,
		37,
	},
	ParamType: vdl.TypeOf((*vdltime.Time)(nil)).Elem(),
}

// MethodCaveat represents a caveat that validates iff the method being
// invoked is included in this list. An empty list implies that the caveat is invalid.
var MethodCaveat = CaveatDescriptor{
	Id: uniqueid.Id{
		84,
		166,
		118,
		57,
		129,
		55,
		24,
		126,
		205,
		178,
		109,
		45,
		105,
		186,
		0,
		3,
	},
	ParamType: vdl.TypeOf((*[]string)(nil)),
}
var PublicKeyThirdPartyCaveat = CaveatDescriptor{
	Id: uniqueid.Id{
		121,
		114,
		206,
		23,
		74,
		123,
		169,
		63,
		121,
		84,
		125,
		118,
		156,
		145,
		128,
		0,
	},
	ParamType: vdl.TypeOf((*publicKeyThirdPartyCaveatParam)(nil)).Elem(),
}

// PeerBlessingsCaveat represents a caveat that validates iff the peer being communicated
// with (local end of the call) has a blessing name matching at least one of the patterns
// in the list. An empty list implies that the caveat is invalid.
var PeerBlessingsCaveat = CaveatDescriptor{
	Id: uniqueid.Id{
		5,
		119,
		248,
		86,
		76,
		142,
		95,
		254,
		255,
		142,
		43,
		31,
		77,
		109,
		128,
		0,
	},
	ParamType: vdl.TypeOf((*[]BlessingPattern)(nil)),
}

// NoExtension is an optional terminator for a blessing pattern indicating that the pattern
// cannot match any extensions of the blessing from that point onwards.
const NoExtension = BlessingPattern("$")

// TODO(ataly, ashankar): The semantics of AllPrincipals breaks monotonicity in
// AccessLists with NotIn clauses. For instance, the AccessList "In: {AllPrincipals}, NotIn: {"foo"}
// matches the principal that presents no recognizable blessings ([]) however does not
// match the principal that presents "foo" as the only recognizable blessings (["foo"])
// We need to sort this out.
const AllPrincipals = BlessingPattern("...")  // Glob pattern that matches all blessings.
const ChainSeparator = ":"                    // ChainSeparator joins blessing names to form a blessing chain name.
const SHA1Hash = Hash("SHA1")                 // SHA1 cryptographic hash function defined in RFC3174.
const SHA256Hash = Hash("SHA256")             // SHA256 cryptographic hash function defined  in FIPS 180-4.
const SHA384Hash = Hash("SHA384")             // SHA384 cryptographic hash function defined in FIPS 180-2.
const SHA512Hash = Hash("SHA512")             // SHA512 cryptographic hash function defined in FIPS 180-2.
const SignatureForMessageSigning = "S1"       // Signature.Purpose used by a Principal to sign arbitrary messages.
const SignatureForBlessingCertificates = "B1" // Signature.Purpose used by a Principal when signing Certificates for creating blessings.
const SignatureForDischarge = "D1"            // Signature.Purpose used by a Principal when signing discharges for public-key based third-party caveats.

// Error definitions
// =================

var (
	ErrCaveatNotRegistered           = verror.NewIDAction("v.io/v23/security.CaveatNotRegistered", verror.NoRetry)
	ErrCaveatParamAny                = verror.NewIDAction("v.io/v23/security.CaveatParamAny", verror.NoRetry)
	ErrCaveatParamTypeMismatch       = verror.NewIDAction("v.io/v23/security.CaveatParamTypeMismatch", verror.NoRetry)
	ErrCaveatParamCoding             = verror.NewIDAction("v.io/v23/security.CaveatParamCoding", verror.NoRetry)
	ErrCaveatValidation              = verror.NewIDAction("v.io/v23/security.CaveatValidation", verror.NoRetry)
	ErrConstCaveatValidation         = verror.NewIDAction("v.io/v23/security.ConstCaveatValidation", verror.NoRetry)
	ErrExpiryCaveatValidation        = verror.NewIDAction("v.io/v23/security.ExpiryCaveatValidation", verror.NoRetry)
	ErrNotBeforeCaveatValidation     = verror.NewIDAction("v.io/v23/security.NotBeforeCaveatValidation", verror.NoRetry)
	ErrMethodCaveatValidation        = verror.NewIDAction("v.io/v23/security.MethodCaveatValidation", verror.NoRetry)
	ErrPeerBlessingsCaveatValidation = verror.NewIDAction("v.io/v23/security.PeerBlessingsCaveatValidation", verror.NoRetry)
	ErrUnrecognizedRoot              = verror.NewIDAction("v.io/v23/security.UnrecognizedRoot", verror.NoRetry)
	ErrAuthorizationFailed           = verror.NewIDAction("v.io/v23/security.AuthorizationFailed", verror.NoRetry)
	ErrInvalidSigningBlessingCaveat  = verror.NewIDAction("v.io/v23/security.InvalidSigningBlessingCaveat", verror.NoRetry)
	ErrPublicKeyNotAllowed           = verror.NewIDAction("v.io/v23/security.PublicKeyNotAllowed", verror.NoRetry)
	ErrEndpointAuthorizationFailed   = verror.NewIDAction("v.io/v23/security.EndpointAuthorizationFailed", verror.NoRetry)
)

// ErrorfCaveatNotRegistered calls ErrCaveatNotRegistered.Errorf with the supplied arguments.
func ErrorfCaveatNotRegistered(ctx *context.T, format string, id uniqueid.Id) error {
	return ErrCaveatNotRegistered.Errorf(ctx, format, id)
}

// MessageCaveatNotRegistered calls ErrCaveatNotRegistered.Message with the supplied arguments.
func MessageCaveatNotRegistered(ctx *context.T, message string, id uniqueid.Id) error {
	return ErrCaveatNotRegistered.Message(ctx, message, id)
}

// ParamsErrCaveatNotRegistered extracts the expected parameters from the error's ParameterList.
func ParamsErrCaveatNotRegistered(argumentError error) (verrorComponent string, verrorOperation string, id uniqueid.Id, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if id, ok = tmp.(uniqueid.Id); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value id, has %T and not uniqueid.Id", tmp)
		return
	}

	return
}

// ErrorfCaveatParamAny calls ErrCaveatParamAny.Errorf with the supplied arguments.
func ErrorfCaveatParamAny(ctx *context.T, format string, id uniqueid.Id) error {
	return ErrCaveatParamAny.Errorf(ctx, format, id)
}

// MessageCaveatParamAny calls ErrCaveatParamAny.Message with the supplied arguments.
func MessageCaveatParamAny(ctx *context.T, message string, id uniqueid.Id) error {
	return ErrCaveatParamAny.Message(ctx, message, id)
}

// ParamsErrCaveatParamAny extracts the expected parameters from the error's ParameterList.
func ParamsErrCaveatParamAny(argumentError error) (verrorComponent string, verrorOperation string, id uniqueid.Id, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if id, ok = tmp.(uniqueid.Id); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value id, has %T and not uniqueid.Id", tmp)
		return
	}

	return
}

// ErrorfCaveatParamTypeMismatch calls ErrCaveatParamTypeMismatch.Errorf with the supplied arguments.
func ErrorfCaveatParamTypeMismatch(ctx *context.T, format string, id uniqueid.Id, got *vdl.Type, want *vdl.Type) error {
	return ErrCaveatParamTypeMismatch.Errorf(ctx, format, id, got, want)
}

// MessageCaveatParamTypeMismatch calls ErrCaveatParamTypeMismatch.Message with the supplied arguments.
func MessageCaveatParamTypeMismatch(ctx *context.T, message string, id uniqueid.Id, got *vdl.Type, want *vdl.Type) error {
	return ErrCaveatParamTypeMismatch.Message(ctx, message, id, got, want)
}

// ParamsErrCaveatParamTypeMismatch extracts the expected parameters from the error's ParameterList.
func ParamsErrCaveatParamTypeMismatch(argumentError error) (verrorComponent string, verrorOperation string, id uniqueid.Id, got *vdl.Type, want *vdl.Type, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if id, ok = tmp.(uniqueid.Id); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value id, has %T and not uniqueid.Id", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if got, ok = tmp.(*vdl.Type); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value got, has %T and not *vdl.Type", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if want, ok = tmp.(*vdl.Type); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value want, has %T and not *vdl.Type", tmp)
		return
	}

	return
}

// ErrorfCaveatParamCoding calls ErrCaveatParamCoding.Errorf with the supplied arguments.
func ErrorfCaveatParamCoding(ctx *context.T, format string, id uniqueid.Id, typ *vdl.Type, err error) error {
	return ErrCaveatParamCoding.Errorf(ctx, format, id, typ, err)
}

// MessageCaveatParamCoding calls ErrCaveatParamCoding.Message with the supplied arguments.
func MessageCaveatParamCoding(ctx *context.T, message string, id uniqueid.Id, typ *vdl.Type, err error) error {
	return ErrCaveatParamCoding.Message(ctx, message, id, typ, err)
}

// ParamsErrCaveatParamCoding extracts the expected parameters from the error's ParameterList.
func ParamsErrCaveatParamCoding(argumentError error) (verrorComponent string, verrorOperation string, id uniqueid.Id, typ *vdl.Type, err error, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if id, ok = tmp.(uniqueid.Id); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value id, has %T and not uniqueid.Id", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if typ, ok = tmp.(*vdl.Type); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value typ, has %T and not *vdl.Type", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if err, ok = tmp.(error); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value err, has %T and not error", tmp)
		return
	}

	return
}

// ErrorfCaveatValidation calls ErrCaveatValidation.Errorf with the supplied arguments.
func ErrorfCaveatValidation(ctx *context.T, format string, err error) error {
	return ErrCaveatValidation.Errorf(ctx, format, err)
}

// MessageCaveatValidation calls ErrCaveatValidation.Message with the supplied arguments.
func MessageCaveatValidation(ctx *context.T, message string, err error) error {
	return ErrCaveatValidation.Message(ctx, message, err)
}

// ParamsErrCaveatValidation extracts the expected parameters from the error's ParameterList.
func ParamsErrCaveatValidation(argumentError error) (verrorComponent string, verrorOperation string, err error, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if err, ok = tmp.(error); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value err, has %T and not error", tmp)
		return
	}

	return
}

// ErrorfConstCaveatValidation calls ErrConstCaveatValidation.Errorf with the supplied arguments.
func ErrorfConstCaveatValidation(ctx *context.T, format string) error {
	return ErrConstCaveatValidation.Errorf(ctx, format)
}

// MessageConstCaveatValidation calls ErrConstCaveatValidation.Message with the supplied arguments.
func MessageConstCaveatValidation(ctx *context.T, message string) error {
	return ErrConstCaveatValidation.Message(ctx, message)
}

// ParamsErrConstCaveatValidation extracts the expected parameters from the error's ParameterList.
func ParamsErrConstCaveatValidation(argumentError error) (verrorComponent string, verrorOperation string, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	return
}

// ErrorfExpiryCaveatValidation calls ErrExpiryCaveatValidation.Errorf with the supplied arguments.
func ErrorfExpiryCaveatValidation(ctx *context.T, format string, currentTime time.Time, expiryTime time.Time) error {
	return ErrExpiryCaveatValidation.Errorf(ctx, format, currentTime, expiryTime)
}

// MessageExpiryCaveatValidation calls ErrExpiryCaveatValidation.Message with the supplied arguments.
func MessageExpiryCaveatValidation(ctx *context.T, message string, currentTime time.Time, expiryTime time.Time) error {
	return ErrExpiryCaveatValidation.Message(ctx, message, currentTime, expiryTime)
}

// ParamsErrExpiryCaveatValidation extracts the expected parameters from the error's ParameterList.
func ParamsErrExpiryCaveatValidation(argumentError error) (verrorComponent string, verrorOperation string, currentTime time.Time, expiryTime time.Time, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if currentTime, ok = tmp.(time.Time); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value currentTime, has %T and not time.Time", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if expiryTime, ok = tmp.(time.Time); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value expiryTime, has %T and not time.Time", tmp)
		return
	}

	return
}

// ErrorfNotBeforeCaveatValidation calls ErrNotBeforeCaveatValidation.Errorf with the supplied arguments.
func ErrorfNotBeforeCaveatValidation(ctx *context.T, format string, currentTime time.Time, expiryTime time.Time) error {
	return ErrNotBeforeCaveatValidation.Errorf(ctx, format, currentTime, expiryTime)
}

// MessageNotBeforeCaveatValidation calls ErrNotBeforeCaveatValidation.Message with the supplied arguments.
func MessageNotBeforeCaveatValidation(ctx *context.T, message string, currentTime time.Time, expiryTime time.Time) error {
	return ErrNotBeforeCaveatValidation.Message(ctx, message, currentTime, expiryTime)
}

// ParamsErrNotBeforeCaveatValidation extracts the expected parameters from the error's ParameterList.
func ParamsErrNotBeforeCaveatValidation(argumentError error) (verrorComponent string, verrorOperation string, currentTime time.Time, expiryTime time.Time, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if currentTime, ok = tmp.(time.Time); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value currentTime, has %T and not time.Time", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if expiryTime, ok = tmp.(time.Time); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value expiryTime, has %T and not time.Time", tmp)
		return
	}

	return
}

// ErrorfMethodCaveatValidation calls ErrMethodCaveatValidation.Errorf with the supplied arguments.
func ErrorfMethodCaveatValidation(ctx *context.T, format string, invokedMethod string, permittedMethods []string) error {
	return ErrMethodCaveatValidation.Errorf(ctx, format, invokedMethod, permittedMethods)
}

// MessageMethodCaveatValidation calls ErrMethodCaveatValidation.Message with the supplied arguments.
func MessageMethodCaveatValidation(ctx *context.T, message string, invokedMethod string, permittedMethods []string) error {
	return ErrMethodCaveatValidation.Message(ctx, message, invokedMethod, permittedMethods)
}

// ParamsErrMethodCaveatValidation extracts the expected parameters from the error's ParameterList.
func ParamsErrMethodCaveatValidation(argumentError error) (verrorComponent string, verrorOperation string, invokedMethod string, permittedMethods []string, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if invokedMethod, ok = tmp.(string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value invokedMethod, has %T and not string", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if permittedMethods, ok = tmp.([]string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value permittedMethods, has %T and not []string", tmp)
		return
	}

	return
}

// ErrorfPeerBlessingsCaveatValidation calls ErrPeerBlessingsCaveatValidation.Errorf with the supplied arguments.
func ErrorfPeerBlessingsCaveatValidation(ctx *context.T, format string, peerBlessings []string, permittedPatterns []BlessingPattern) error {
	return ErrPeerBlessingsCaveatValidation.Errorf(ctx, format, peerBlessings, permittedPatterns)
}

// MessagePeerBlessingsCaveatValidation calls ErrPeerBlessingsCaveatValidation.Message with the supplied arguments.
func MessagePeerBlessingsCaveatValidation(ctx *context.T, message string, peerBlessings []string, permittedPatterns []BlessingPattern) error {
	return ErrPeerBlessingsCaveatValidation.Message(ctx, message, peerBlessings, permittedPatterns)
}

// ParamsErrPeerBlessingsCaveatValidation extracts the expected parameters from the error's ParameterList.
func ParamsErrPeerBlessingsCaveatValidation(argumentError error) (verrorComponent string, verrorOperation string, peerBlessings []string, permittedPatterns []BlessingPattern, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if peerBlessings, ok = tmp.([]string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value peerBlessings, has %T and not []string", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if permittedPatterns, ok = tmp.([]BlessingPattern); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value permittedPatterns, has %T and not []BlessingPattern", tmp)
		return
	}

	return
}

// ErrorfUnrecognizedRoot calls ErrUnrecognizedRoot.Errorf with the supplied arguments.
func ErrorfUnrecognizedRoot(ctx *context.T, format string, rootKey string, details error) error {
	return ErrUnrecognizedRoot.Errorf(ctx, format, rootKey, details)
}

// MessageUnrecognizedRoot calls ErrUnrecognizedRoot.Message with the supplied arguments.
func MessageUnrecognizedRoot(ctx *context.T, message string, rootKey string, details error) error {
	return ErrUnrecognizedRoot.Message(ctx, message, rootKey, details)
}

// ParamsErrUnrecognizedRoot extracts the expected parameters from the error's ParameterList.
func ParamsErrUnrecognizedRoot(argumentError error) (verrorComponent string, verrorOperation string, rootKey string, details error, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if rootKey, ok = tmp.(string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value rootKey, has %T and not string", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if details, ok = tmp.(error); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value details, has %T and not error", tmp)
		return
	}

	return
}

// ErrorfAuthorizationFailed calls ErrAuthorizationFailed.Errorf with the supplied arguments.
func ErrorfAuthorizationFailed(ctx *context.T, format string, remote []string, remoteErr []RejectedBlessing, local []string) error {
	return ErrAuthorizationFailed.Errorf(ctx, format, remote, remoteErr, local)
}

// MessageAuthorizationFailed calls ErrAuthorizationFailed.Message with the supplied arguments.
func MessageAuthorizationFailed(ctx *context.T, message string, remote []string, remoteErr []RejectedBlessing, local []string) error {
	return ErrAuthorizationFailed.Message(ctx, message, remote, remoteErr, local)
}

// ParamsErrAuthorizationFailed extracts the expected parameters from the error's ParameterList.
func ParamsErrAuthorizationFailed(argumentError error) (verrorComponent string, verrorOperation string, remote []string, remoteErr []RejectedBlessing, local []string, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if remote, ok = tmp.([]string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value remote, has %T and not []string", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if remoteErr, ok = tmp.([]RejectedBlessing); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value remoteErr, has %T and not []RejectedBlessing", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if local, ok = tmp.([]string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value local, has %T and not []string", tmp)
		return
	}

	return
}

// ErrorfInvalidSigningBlessingCaveat calls ErrInvalidSigningBlessingCaveat.Errorf with the supplied arguments.
func ErrorfInvalidSigningBlessingCaveat(ctx *context.T, format string, id uniqueid.Id) error {
	return ErrInvalidSigningBlessingCaveat.Errorf(ctx, format, id)
}

// MessageInvalidSigningBlessingCaveat calls ErrInvalidSigningBlessingCaveat.Message with the supplied arguments.
func MessageInvalidSigningBlessingCaveat(ctx *context.T, message string, id uniqueid.Id) error {
	return ErrInvalidSigningBlessingCaveat.Message(ctx, message, id)
}

// ParamsErrInvalidSigningBlessingCaveat extracts the expected parameters from the error's ParameterList.
func ParamsErrInvalidSigningBlessingCaveat(argumentError error) (verrorComponent string, verrorOperation string, id uniqueid.Id, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if id, ok = tmp.(uniqueid.Id); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value id, has %T and not uniqueid.Id", tmp)
		return
	}

	return
}

// ErrorfPublicKeyNotAllowed calls ErrPublicKeyNotAllowed.Errorf with the supplied arguments.
func ErrorfPublicKeyNotAllowed(ctx *context.T, format string, got string, want string) error {
	return ErrPublicKeyNotAllowed.Errorf(ctx, format, got, want)
}

// MessagePublicKeyNotAllowed calls ErrPublicKeyNotAllowed.Message with the supplied arguments.
func MessagePublicKeyNotAllowed(ctx *context.T, message string, got string, want string) error {
	return ErrPublicKeyNotAllowed.Message(ctx, message, got, want)
}

// ParamsErrPublicKeyNotAllowed extracts the expected parameters from the error's ParameterList.
func ParamsErrPublicKeyNotAllowed(argumentError error) (verrorComponent string, verrorOperation string, got string, want string, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if got, ok = tmp.(string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value got, has %T and not string", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if want, ok = tmp.(string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value want, has %T and not string", tmp)
		return
	}

	return
}

// ErrorfEndpointAuthorizationFailed calls ErrEndpointAuthorizationFailed.Errorf with the supplied arguments.
func ErrorfEndpointAuthorizationFailed(ctx *context.T, format string, endpoint string, remote []string, rejected []RejectedBlessing) error {
	return ErrEndpointAuthorizationFailed.Errorf(ctx, format, endpoint, remote, rejected)
}

// MessageEndpointAuthorizationFailed calls ErrEndpointAuthorizationFailed.Message with the supplied arguments.
func MessageEndpointAuthorizationFailed(ctx *context.T, message string, endpoint string, remote []string, rejected []RejectedBlessing) error {
	return ErrEndpointAuthorizationFailed.Message(ctx, message, endpoint, remote, rejected)
}

// ParamsErrEndpointAuthorizationFailed extracts the expected parameters from the error's ParameterList.
func ParamsErrEndpointAuthorizationFailed(argumentError error) (verrorComponent string, verrorOperation string, endpoint string, remote []string, rejected []RejectedBlessing, returnErr error) {
	params := verror.Params(argumentError)
	if params == nil {
		returnErr = fmt.Errorf("no parameters found in: %T: %v", argumentError, argumentError)
		return
	}
	iter := &paramListIterator{params: params, max: len(params)}

	if verrorComponent, verrorOperation, returnErr = iter.preamble(); returnErr != nil {
		return
	}

	var (
		tmp interface{}
		ok  bool
	)
	tmp, returnErr = iter.next()
	if endpoint, ok = tmp.(string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value endpoint, has %T and not string", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if remote, ok = tmp.([]string); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value remote, has %T and not []string", tmp)
		return
	}
	tmp, returnErr = iter.next()
	if rejected, ok = tmp.([]RejectedBlessing); !ok {
		if returnErr != nil {
			return
		}
		returnErr = fmt.Errorf("parameter list contains the wrong type for return value rejected, has %T and not []RejectedBlessing", tmp)
		return
	}

	return
}

type paramListIterator struct {
	err      error
	idx, max int
	params   []interface{}
}

func (pl *paramListIterator) next() (interface{}, error) {
	if pl.err != nil {
		return nil, pl.err
	}
	if pl.idx+1 > pl.max {
		pl.err = fmt.Errorf("too few parameters: have %v", pl.max)
		return nil, pl.err
	}
	pl.idx++
	return pl.params[pl.idx-1], nil
}

func (pl *paramListIterator) preamble() (component, operation string, err error) {
	var tmp interface{}
	if tmp, err = pl.next(); err != nil {
		return
	}
	var ok bool
	if component, ok = tmp.(string); !ok {
		return "", "", fmt.Errorf("ParamList[0]: component name is not a string: %T", tmp)
	}
	if tmp, err = pl.next(); err != nil {
		return
	}
	if operation, ok = tmp.(string); !ok {
		return "", "", fmt.Errorf("ParamList[1]: operation name is not a string: %T", tmp)
	}
	return
}

// initializeVDL performs vdl initialization.  It is safe to call multiple times.
// If you have an init ordering issue, just insert the following line verbatim
// into your source files in this package, right after the "package foo" clause:
//
// var _ = initializeVDL()
//
// The purpose of this function is to ensure that vdl initialization occurs in
// the right order, and very early in the init sequence.  In particular, vdl
// registration and package variable initialization needs to occur before
// functions like vdl.TypeOf will work properly.
//
// This function returns a dummy value, so that it can be used to initialize the
// first var in the file, to take advantage of Go's defined init order.
func initializeVDL() struct{} {
	if initializeVDLCalled {
		return struct{}{}
	}
	initializeVDLCalled = true

	// Register native type conversions first, so that vdl.TypeOf works.
	vdl.RegisterNative(WireBlessingsToNative, WireBlessingsFromNative)
	vdl.RegisterNative(WireDischargeToNative, WireDischargeFromNative)

	// Register types.
	vdl.Register((*nonce)(nil))
	vdl.Register((*Caveat)(nil))
	vdl.Register((*ThirdPartyRequirements)(nil))
	vdl.Register((*publicKeyThirdPartyCaveatParam)(nil))
	vdl.Register((*Hash)(nil))
	vdl.Register((*Signature)(nil))
	vdl.Register((*PublicKeyDischarge)(nil))
	vdl.Register((*BlessingPattern)(nil))
	vdl.Register((*EcdsaOnlySignature)(nil))
	vdl.Register((*DischargeImpetus)(nil))
	vdl.Register((*Certificate)(nil))
	vdl.Register((*CaveatDescriptor)(nil))
	vdl.Register((*WireBlessings)(nil))
	vdl.Register((*WireDischarge)(nil))
	vdl.Register((*RejectedBlessing)(nil))

	// Initialize type definitions.
	vdlTypeArray1 = vdl.TypeOf((*nonce)(nil))
	vdlTypeStruct2 = vdl.TypeOf((*Caveat)(nil)).Elem()
	vdlTypeArray3 = vdl.TypeOf((*uniqueid.Id)(nil))
	vdlTypeList4 = vdl.TypeOf((*[]byte)(nil))
	vdlTypeStruct5 = vdl.TypeOf((*ThirdPartyRequirements)(nil)).Elem()
	vdlTypeStruct6 = vdl.TypeOf((*publicKeyThirdPartyCaveatParam)(nil)).Elem()
	vdlTypeList7 = vdl.TypeOf((*[]Caveat)(nil))
	vdlTypeString8 = vdl.TypeOf((*Hash)(nil))
	vdlTypeStruct9 = vdl.TypeOf((*Signature)(nil)).Elem()
	vdlTypeStruct10 = vdl.TypeOf((*PublicKeyDischarge)(nil)).Elem()
	vdlTypeString11 = vdl.TypeOf((*BlessingPattern)(nil))
	vdlTypeStruct12 = vdl.TypeOf((*EcdsaOnlySignature)(nil)).Elem()
	vdlTypeStruct13 = vdl.TypeOf((*DischargeImpetus)(nil)).Elem()
	vdlTypeList14 = vdl.TypeOf((*[]BlessingPattern)(nil))
	vdlTypeList15 = vdl.TypeOf((*[]*vom.RawBytes)(nil))
	vdlTypeStruct16 = vdl.TypeOf((*Certificate)(nil)).Elem()
	vdlTypeStruct17 = vdl.TypeOf((*CaveatDescriptor)(nil)).Elem()
	vdlTypeStruct18 = vdl.TypeOf((*WireBlessings)(nil)).Elem()
	vdlTypeList19 = vdl.TypeOf((*[][]Certificate)(nil))
	vdlTypeList20 = vdl.TypeOf((*[]Certificate)(nil))
	vdlTypeUnion21 = vdl.TypeOf((*WireDischarge)(nil))
	vdlTypeStruct22 = vdl.TypeOf((*RejectedBlessing)(nil)).Elem()

	return struct{}{}
}