From afa7a39985c6a9d7a44d7460c653712175aeb93b Mon Sep 17 00:00:00 2001
From: James Rosewell <james@51degrees.com>
Date: Thu, 3 Sep 2026 13:29:15 +0100
Subject: [PATCH] FEAT: Read the misconfigured and invalid date creator context
 outcomes

The cloud is gaining two context results and a third factor result, and
without these a client reports them wrongly rather than not at all.

A factor of "misconfigured" says the checking service is not configured to
determine that factor, so it could not have checked it for any request. It
is not a mismatch, and a client that let it fall through to one would report
a replay indicator for something the identifier says nothing about.

A context of "misconfigured" says the service could not complete the check,
either compared nothing or compared some factors with at least one it could
not determine. A context of "invaliddate" says the creation date is one the
scheme could not have produced, being in the future or before the creator
context began, so the identifier is fabricated rather than anything being
wrong with the service. Neither is reachable by anything a caller sends.

The existing value for a context that could not be checked is kept, because
it has been public since this enumeration was added, and its documentation
now says the service no longer sends it and which value replaced it in each
case. Both new values are added at the end, so no existing value moves.
---
 .../src/fiftyone_pipeline_did/did_client.py   | 32 ++++++++++++++++---
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/fiftyone_pipeline_did/src/fiftyone_pipeline_did/did_client.py b/fiftyone_pipeline_did/src/fiftyone_pipeline_did/did_client.py
index b84feff..484aefc 100644
--- a/fiftyone_pipeline_did/src/fiftyone_pipeline_did/did_client.py
+++ b/fiftyone_pipeline_did/src/fiftyone_pipeline_did/did_client.py
@@ -112,8 +112,22 @@ class ContextResult(str, Enum):
     MISMATCH = "mismatch"
     #: The identifier carries no creator context.
     NO_CONTEXT = "nocontext"
-    #: The service holds no secret covering the identifier's date.
+    #: No longer sent by the service, and kept only because it has been
+    #: public since this enumeration was added. What used to give this
+    #: answer now gives :attr:`MISCONFIGURED` where the service is at fault,
+    #: or :attr:`INVALID_DATE` where the identifier could not have been
+    #: created.
     NOT_CHECKABLE = "notcheckable"
+    #: The service that checked the identifier could not complete the check,
+    #: and the reason is that service rather than the identifier. It either
+    #: compared nothing, or compared some factors and reports at least one
+    #: as :attr:`FactorResult.MISCONFIGURED`. Nothing a caller sends can
+    #: produce it, so it is a signal about the deployment.
+    MISCONFIGURED = "misconfigured"
+    #: The creation date is one the scheme could not have produced, being in
+    #: the future or before the creator context scheme began, so the
+    #: identifier is fabricated rather than the service being wrong.
+    INVALID_DATE = "invaliddate"
     #: The sealed result was redeemed outside the freshness window.
     EXPIRED = "expired"
     #: The sealed result had already been redeemed on that instance.
@@ -138,12 +152,17 @@ class SignatureResult(str, Enum):
 
 
 class FactorResult(str, Enum):
-    """The outcome of one factor in a mismatch. The cloud reports ``null``
-    for a factor that was not compared, which is passed through as
-    ``None``."""
+    """The outcome of one factor in a mismatch or a partly misconfigured
+    result. The cloud reports ``null`` for a factor that was not compared,
+    which is passed through as ``None``."""
 
     VERIFIED = "verified"
     MISMATCH = "mismatch"
+    #: The service that checked the identifier is not configured to
+    #: determine this factor, so it could not have checked it for any
+    #: request. This is NOT a mismatch and must not be read as one, since
+    #: the identifier says nothing about it either way.
+    MISCONFIGURED = "misconfigured"
 
 
 class SignatureReason(str, Enum):
@@ -362,6 +381,11 @@ def _factor_of(value: Any) -> FactorValue:
         return FactorResult.VERIFIED
     if value == "mismatch":
         return FactorResult.MISMATCH
+    # Read on its own rather than left to fall through, because it says the
+    # checking service could not determine the factor and must never be
+    # taken for a mismatch.
+    if value == "misconfigured":
+        return FactorResult.MISCONFIGURED
     return None