DeviceAuthenticationHealth
The state of this device's server authentication credentials, as classified by SecureMessageClient.deviceAuthenticationHealth (docs/device-authentication-health.md). A read-only composition of the local device authentication key slots and, only when they do not decide, the signed registration status: factual states only, no severity and no recommendation. The application decides what to show and what to do.
Not an atomic snapshot: the state can change right after it was read. Carries no key material.
Inheritors
Types
The local identity exists, but the active device authentication key is missing and no transition is pending. It is never recreated: the device needs a recovery (docs/device-recovery.md, docs/last-device-recovery.md). The server was not asked.
The active key is present, the server has a registration for this device and no transition is pending locally. With a policy, the key is younger than DeviceAuthenticationRotationPolicy.maxKeyAge; without one (null), the age was not evaluated against anything.
The local key slots contradict each other; impossible while the storage keeps its invariants.
A replacement key of a device recovery or a last-device recovery (kind) is pending locally, whether the active key is present or not. The server was not asked; nothing was completed or resolved.
As Healthy, but the registered key reached policy's maximum age (DeviceAuthenticationRotationStatus.age>= DeviceAuthenticationRotationPolicy.maxKeyAge) by the client clock. Nothing was rotated.
A routine rotation key is pending locally and the active key is present. The server was not asked; nothing was completed or resolved.
The active key is present, but the server has no registration for this device. Nothing was registered.