Check client conditional request

8 files changed, 483 insertions, 272 deletions

diff --git a/doc/webid-oidc.texi b/doc/webid-oidc.texi
index 5900256..039bf30 100644
--- a/doc/webid-oidc.texi
+++ b/doc/webid-oidc.texi
@@ -1284,6 +1284,15 @@ resource, at @var{path}.
 The @var{user} wanted to do something under @var{path} requiring
 @var{mode}, but it is not the @var{owner} and it is forbidden by WAC.
 @end deftp
+
+@deftp {exception type} &precondition-failed @var{path} @var{if-match} @var{if-none-match} @var{real-etag}
+The resource under @var{path} has a @var{real-etag} that does not
+match the request headers @var{if-match} and @var{if-none-match}.
+
+If the resource does not exist, @var{real-etag} is set to
+@code{#f}. In this case, an exception of type @code{&path-not-found}
+is also thrown.
+@end deftp
 @node GNU Free Documentation License
 @appendix GNU Free Documentation License
 
diff --git a/po/fr.po b/po/fr.po
index 9660730..6d018cf 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc 0.0.0\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-06-19 11:40+0200\n"
-"PO-Revision-Date: 2021-06-19 11:41+0200\n"
+"POT-Creation-Date: 2021-06-27 00:19+0200\n"
+"PO-Revision-Date: 2021-06-24 20:27+0200\n"
 "Last-Translator: Vivien Kraus <vivien@planete-kraus.eu>\n"
 "Language-Team: French <vivien@planete-kraus.eu>\n"
 "Language: fr\n"
@@ -126,101 +126,101 @@ msgstr "Utilisation : generate-random [NOMBRE D'OCTETS]\n"
 msgid "Usage: generate-key [NUMBER OF BITS | CURVE]\n"
 msgstr "Utilisation : generate-key [NOMBRE DE BITS | COURBE]\n"
 
-#: src/scm/webid-oidc/errors.scm:1013
+#: src/scm/webid-oidc/errors.scm:1031
 msgid "that’s how it is"
 msgstr "c’est comme ça"
 
-#: src/scm/webid-oidc/errors.scm:1018
+#: src/scm/webid-oidc/errors.scm:1036
 #, scheme-format
 msgid "the value ~s is not a base64 string (because ~a)"
 msgstr "la valeur ~s n’est pas une chaîne base64 (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1021
+#: src/scm/webid-oidc/errors.scm:1039
 #, scheme-format
 msgid "the value ~s is not JSON (because ~a)"
 msgstr "la valeur ~s n’est pas du JSON (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1024
+#: src/scm/webid-oidc/errors.scm:1042
 #, scheme-format
 msgid "the value ~s is not Turtle (because ~a)"
 msgstr "la valeur ~s n’est pas du Turtle (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1027
+#: src/scm/webid-oidc/errors.scm:1045
 #, scheme-format
 msgid "the value ~s does not identify an elleptic curve"
 msgstr "la valeur ~s n’identifie pas une courbe elliptique"
 
-#: src/scm/webid-oidc/errors.scm:1032
+#: src/scm/webid-oidc/errors.scm:1050
 #, scheme-format
 msgid "the value ~s does not identify a JWK (because ~a)"
 msgstr "la valeur ~s n’identifie pas une JWK (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1034
+#: src/scm/webid-oidc/errors.scm:1052
 #, scheme-format
 msgid "the value ~s does not identify a JWK"
 msgstr "la valeur ~s n’identifie pas une JWK"
 
-#: src/scm/webid-oidc/errors.scm:1039
+#: src/scm/webid-oidc/errors.scm:1057
 #, scheme-format
 msgid "the value ~s does not identify a public JWK (because ~a)"
 msgstr "la valeur ~s n’identifie pas une JWK publique (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1041
+#: src/scm/webid-oidc/errors.scm:1059
 #, scheme-format
 msgid "the value ~s does not identify a public JWK"
 msgstr "la valeur ~s n’identifie pas une JWK publique"
 
-#: src/scm/webid-oidc/errors.scm:1046
+#: src/scm/webid-oidc/errors.scm:1064
 #, scheme-format
 msgid "the value ~s does not identify a private JWK (because ~a)"
 msgstr "la valeur ~s n’identifie pas une JWK privée (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1048
+#: src/scm/webid-oidc/errors.scm:1066
 #, scheme-format
 msgid "the value ~s does not identify a private JWK"
 msgstr "la valeur ~s n’identifie pas une JWK privée"
 
-#: src/scm/webid-oidc/errors.scm:1053
+#: src/scm/webid-oidc/errors.scm:1071
 #, scheme-format
 msgid "the value ~s does not identify a JWKS (because ~a)"
 msgstr "la valeur ~s n’identifie pas un JWKS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1055
+#: src/scm/webid-oidc/errors.scm:1073
 #, scheme-format
 msgid "the value ~s does not identify a JWKS"
 msgstr "la valeur ~s n’identifie pas un JWKS"
 
-#: src/scm/webid-oidc/errors.scm:1058
+#: src/scm/webid-oidc/errors.scm:1076
 #, scheme-format
 msgid "the value ~s does not identify a hash algorithm"
 msgstr "la valeur ~s n’identifie pas un algorithme de hachage"
 
-#: src/scm/webid-oidc/errors.scm:1061
+#: src/scm/webid-oidc/errors.scm:1079
 #, scheme-format
 msgid "the value ~s is not an alist or misses key ~s"
 msgstr "la valeur ~s n’est pas une alist ou il manque la clé ~s"
 
-#: src/scm/webid-oidc/errors.scm:1064
+#: src/scm/webid-oidc/errors.scm:1082
 #, scheme-format
 msgid "the value ~s is not a JWS header (because ~a)"
 msgstr "la valeur ~s n’est pas un header JWS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1067
+#: src/scm/webid-oidc/errors.scm:1085
 #, scheme-format
 msgid "the value ~s is not a JWS payload (because ~a)"
 msgstr "la valeur ~s n’est pas un contenu JWS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1070
+#: src/scm/webid-oidc/errors.scm:1088
 #, scheme-format
 msgid "the value ~s is not a JWS (because ~a)"
 msgstr "la valeur ~s n’est pas un JWS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1073
+#: src/scm/webid-oidc/errors.scm:1091
 #, scheme-format
 msgid "the string ~s cannot be split in 3 parts with ~s"
 msgstr "la chaîne ~s ne peut pas être découpée en 3 parties avec ~s"
 
-#: src/scm/webid-oidc/errors.scm:1076
+#: src/scm/webid-oidc/errors.scm:1094
 #, scheme-format
 msgid ""
 "all key candidates failed to verify signature ~s with algorithm ~s and "
@@ -229,17 +229,17 @@ msgstr ""
 "aucune clé candidate n’a pu vérifier la signature ~s avec l’algorithme ~s et "
 "le contenu ~a (il y en avait ~a : ~s)"
 
-#: src/scm/webid-oidc/errors.scm:1079
+#: src/scm/webid-oidc/errors.scm:1097
 #, scheme-format
 msgid "I cannot decode JWS ~a (because ~a)"
 msgstr "je n’ai pas pu décoder le JWS encodé par ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1082
+#: src/scm/webid-oidc/errors.scm:1100
 #, scheme-format
 msgid "I cannot encode JWS ~a (because ~a)"
 msgstr "je n’ai pas pu encoder le JWS ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1085
+#: src/scm/webid-oidc/errors.scm:1103
 #, scheme-format
 msgid ""
 "the server request unexpectedly failed with code ~a and reason phrase ~s"
@@ -247,338 +247,338 @@ msgstr ""
 "la requête au serveur a échoué de façon inattendue avec un code ~a et une "
 "raison ~s"
 
-#: src/scm/webid-oidc/errors.scm:1090
+#: src/scm/webid-oidc/errors.scm:1108
 #, scheme-format
 msgid "the header ~a should not have the value ~s"
 msgstr "l’en-tête ~a ne devrait pas avoir la valeur ~s"
 
-#: src/scm/webid-oidc/errors.scm:1092
+#: src/scm/webid-oidc/errors.scm:1110
 #, scheme-format
 msgid "the header ~a should be present"
 msgstr "l’en-tête ~a devrait être présent"
 
-#: src/scm/webid-oidc/errors.scm:1095
+#: src/scm/webid-oidc/errors.scm:1113
 #, scheme-format
 msgid "the server response wasn't expected: ~s (because ~a)"
 msgstr "la réponse du serveur est inattendue : ~s (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1101
+#: src/scm/webid-oidc/errors.scm:1119
 #, scheme-format
 msgid "the value ~s is not an OIDC configuration (because ~a)"
 msgstr "la valeur ~s n’est pas une configuration OIDC (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1106
+#: src/scm/webid-oidc/errors.scm:1124
 #, scheme-format
 msgid "the webid field is incorrect: ~s"
 msgstr "le champ webid est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1107
+#: src/scm/webid-oidc/errors.scm:1125
 msgid "the webid field is missing"
 msgstr "le champ webid est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1111
+#: src/scm/webid-oidc/errors.scm:1129
 #, scheme-format
 msgid "the sub field is incorrect: ~s"
 msgstr "le champ sub est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1112
+#: src/scm/webid-oidc/errors.scm:1130
 msgid "the sub field is missing"
 msgstr "le champ sub est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1116
+#: src/scm/webid-oidc/errors.scm:1134
 #, scheme-format
 msgid "the iss field is incorrect: ~s"
 msgstr "le champ iss est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1117
+#: src/scm/webid-oidc/errors.scm:1135
 msgid "the iss field is missing"
 msgstr "le champ iss est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1121
+#: src/scm/webid-oidc/errors.scm:1139
 #, scheme-format
 msgid "the aud field is incorrect: ~s"
 msgstr "le champ aud est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1122
+#: src/scm/webid-oidc/errors.scm:1140
 msgid "the aud field is missing"
 msgstr "le champ aud est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1126
+#: src/scm/webid-oidc/errors.scm:1144
 #, scheme-format
 msgid "the iat field is incorrect: ~s"
 msgstr "le champ iat est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1127
+#: src/scm/webid-oidc/errors.scm:1145
 msgid "the iat field is missing"
 msgstr "le champ iat est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1131
+#: src/scm/webid-oidc/errors.scm:1149
 #, scheme-format
 msgid "the exp field is incorrect: ~s"
 msgstr "le champ exp est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1132
+#: src/scm/webid-oidc/errors.scm:1150
 msgid "the exp field is missing"
 msgstr "le champ exp est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1136
+#: src/scm/webid-oidc/errors.scm:1154
 #, scheme-format
 msgid "the cnf/jkt field is incorrect: ~s"
 msgstr "le champ cnf/jkt est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1137
+#: src/scm/webid-oidc/errors.scm:1155
 msgid "the cnf/jkt field is missing"
 msgstr "le champ cnf/jkt est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1141
+#: src/scm/webid-oidc/errors.scm:1159
 #, scheme-format
 msgid "the client-id field is incorrect: ~s"
 msgstr "le champ client-id est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1142
+#: src/scm/webid-oidc/errors.scm:1160
 msgid "the client-id field is missing"
 msgstr "le champ client-id est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1146
+#: src/scm/webid-oidc/errors.scm:1164
 #: src/scm/webid-oidc/authorization-page-unsafe.scm:133
 #, scheme-format
 msgid "the redirect_uris field is incorrect: ~s"
 msgstr "le champ redirect_uris est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1147
+#: src/scm/webid-oidc/errors.scm:1165
 #: src/scm/webid-oidc/authorization-page-unsafe.scm:134
 msgid "the redirect_uris field is missing"
 msgstr "le champ redirect_uris est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1151
+#: src/scm/webid-oidc/errors.scm:1169
 #, scheme-format
 msgid "the typ field is incorrect: ~s"
 msgstr "le champ typ est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1152
+#: src/scm/webid-oidc/errors.scm:1170
 msgid "the typ field is missing"
 msgstr "le champ typ est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1156
+#: src/scm/webid-oidc/errors.scm:1174
 #, scheme-format
 msgid "the jwk field is incorrect: ~s (because ~a)"
 msgstr "le champ jwk est incorrect : ~s (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1158
+#: src/scm/webid-oidc/errors.scm:1176
 msgid "the jwk field is missing"
 msgstr "le champ jwk est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1162
+#: src/scm/webid-oidc/errors.scm:1180
 #, scheme-format
 msgid "the jti field is incorrect: ~s"
 msgstr "le champ jti est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1163
+#: src/scm/webid-oidc/errors.scm:1181
 msgid "the jti field is missing"
 msgstr "le champ jti est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1167
+#: src/scm/webid-oidc/errors.scm:1185
 #, scheme-format
 msgid "the nonce field is incorrect: ~s"
 msgstr "le champ nonce est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1168
+#: src/scm/webid-oidc/errors.scm:1186
 msgid "the nonce field is missing"
 msgstr "le champ nonce est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1172
+#: src/scm/webid-oidc/errors.scm:1190
 #, scheme-format
 msgid "the htm field is incorrect: ~s"
 msgstr "le champ htm est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1173
+#: src/scm/webid-oidc/errors.scm:1191
 msgid "the htm field is missing"
 msgstr "le champ htm est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1177
+#: src/scm/webid-oidc/errors.scm:1195
 #, scheme-format
 msgid "the htu field is incorrect: ~s"
 msgstr "le champ htu est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1178
+#: src/scm/webid-oidc/errors.scm:1196
 msgid "the htu field is missing"
 msgstr "le champ htu est manquant"
 
-#: src/scm/webid-oidc/errors.scm:1180
+#: src/scm/webid-oidc/errors.scm:1198
 #, scheme-format
 msgid "~s is not an access token (because ~a)"
 msgstr "~s n’est pas un jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1183
+#: src/scm/webid-oidc/errors.scm:1201
 #, scheme-format
 msgid "~s is not an access token header (because ~a)"
 msgstr "~s n’est pas un en-tête de jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1186
+#: src/scm/webid-oidc/errors.scm:1204
 #, scheme-format
 msgid "~s is not an access token payload (because ~a)"
 msgstr "~s n’est pas un contenu de jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1189
+#: src/scm/webid-oidc/errors.scm:1207
 #, scheme-format
 msgid "~s is not a DPoP proof (because ~a)"
 msgstr "~s n’est pas une preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1192
+#: src/scm/webid-oidc/errors.scm:1210
 #, scheme-format
 msgid "~s is not a DPoP proof header (because ~a)"
 msgstr "~s n’est pas un en-tête de preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1195
+#: src/scm/webid-oidc/errors.scm:1213
 #, scheme-format
 msgid "~s is not a DPoP proof payload (because ~a)"
 msgstr "~s n’est pas un contenu de preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1198
+#: src/scm/webid-oidc/errors.scm:1216
 #, scheme-format
 msgid "I cannot fetch the issuer configuration of ~a (because ~a)"
 msgstr ""
 "je n’ai pas pu récupérer la configuration de l’émetteur ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1205
+#: src/scm/webid-oidc/errors.scm:1223
 #, scheme-format
 msgid "I cannot fetch the JWKS of ~a at ~a (because ~a)"
 msgstr "je n’ai pas pu récupérer le JWKS de ~a à ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1216
+#: src/scm/webid-oidc/errors.scm:1234
 #, scheme-format
 msgid "the HTTP method is signed for ~s, but ~s was requested"
 msgstr "la méthode HTTP a été signée pour ~s, mais ~s a été demandé"
 
-#: src/scm/webid-oidc/errors.scm:1219
+#: src/scm/webid-oidc/errors.scm:1237
 #, scheme-format
 msgid "the HTTP uri is signed for ~a, but ~a was requested"
 msgstr "l’uri HTTP a été signé pour ~a, mais ~a a été demandé"
 
-#: src/scm/webid-oidc/errors.scm:1222
+#: src/scm/webid-oidc/errors.scm:1240
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof is signed in the future at ~a"
 msgstr "la date est ~a, mais la preuve DPoP a été signée dans le futur à ~a"
 
-#: src/scm/webid-oidc/errors.scm:1226
+#: src/scm/webid-oidc/errors.scm:1244
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof was signed too long ago at ~a"
 msgstr ""
 "la date est ~a, mais la preuve DPoP a été signée il y a trop longtemps à ~a"
 
-#: src/scm/webid-oidc/errors.scm:1235
+#: src/scm/webid-oidc/errors.scm:1253
 #, scheme-format
 msgid "the key ~s does not hash to ~a"
 msgstr "la clé ~s ne donne pas un hash de ~a"
 
-#: src/scm/webid-oidc/errors.scm:1237
+#: src/scm/webid-oidc/errors.scm:1255
 #, scheme-format
 msgid "the key confirmation of ~s failed (because ~a)"
 msgstr "la confirmation de clé de ~s a échoué (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1239
+#: src/scm/webid-oidc/errors.scm:1257
 #, scheme-format
 msgid "the key confirmation of ~s failed"
 msgstr "la confirmation de la clé ~s a échoué"
 
-#: src/scm/webid-oidc/errors.scm:1241
+#: src/scm/webid-oidc/errors.scm:1259
 #, scheme-format
 msgid "the jti ~s has already been found (because ~a)"
 msgstr "le jti ~s a déjà été trouvé (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1244
+#: src/scm/webid-oidc/errors.scm:1262
 #, scheme-format
 msgid "I cannot decode ~s as an access token (because ~a)"
 msgstr "je n’ai pas pu décoder ~s comme jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1247
+#: src/scm/webid-oidc/errors.scm:1265
 #, scheme-format
 msgid "I cannot encode ~s as an access token with key ~s (because ~a)"
 msgstr ""
 "je n’ai pas pu encoder ~s comme un jeton d’accès avec la clé ~s (parce que "
 "~a)"
 
-#: src/scm/webid-oidc/errors.scm:1250
+#: src/scm/webid-oidc/errors.scm:1268
 #, scheme-format
 msgid "I cannot decode ~s as a DPoP proof (because ~a)"
 msgstr "je n’ai pas pu décoder ~s comme preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1253
+#: src/scm/webid-oidc/errors.scm:1271
 #, scheme-format
 msgid "I cannot encode ~s as a DPoP proof (because ~a)"
 msgstr "je n’ai pas pu encoder ~s comme une preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1256
+#: src/scm/webid-oidc/errors.scm:1274
 #, scheme-format
 msgid "I could not fetch a RDF graph at ~a (because ~a)"
 msgstr "je n’ai pas pu récupérer de graphe RDF à ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1259
+#: src/scm/webid-oidc/errors.scm:1277
 #, scheme-format
 msgid "~s is not a client manifest (because ~a)"
 msgstr "~s n’est pas un manifeste client (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1262
+#: src/scm/webid-oidc/errors.scm:1280
 #, scheme-format
 msgid "~s does not authorize redirection URI ~a"
 msgstr "~s n’autorise pas l’URI de redirection ~a"
 
-#: src/scm/webid-oidc/errors.scm:1265
+#: src/scm/webid-oidc/errors.scm:1283
 msgid "I cannot serve a public manifest"
 msgstr "je ne peux pas servir un manifeste public"
 
-#: src/scm/webid-oidc/errors.scm:1267
+#: src/scm/webid-oidc/errors.scm:1285
 #, scheme-format
 msgid "~a does not have a client manifest registration triple"
 msgstr "~a n’a pas de triplet d’enregistrement de manifeste client"
 
-#: src/scm/webid-oidc/errors.scm:1270
+#: src/scm/webid-oidc/errors.scm:1288
 #, scheme-format
 msgid "the client manifest at ~a is advertised for ~a"
 msgstr "le manifeste client ~a est publié pour ~a"
 
-#: src/scm/webid-oidc/errors.scm:1273
+#: src/scm/webid-oidc/errors.scm:1291
 #, scheme-format
 msgid "I could not fetch the client manifest of ~a (because ~a)"
 msgstr "je n’ai pas pu récupérer le manifeste client de ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1276
+#: src/scm/webid-oidc/errors.scm:1294
 #, scheme-format
 msgid "~s is not an authorization code (because ~a)"
 msgstr "~s n’est pas un code d’autorisation (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1279
+#: src/scm/webid-oidc/errors.scm:1297
 #, scheme-format
 msgid "~s is not an authorization code header (because ~a)"
 msgstr "~s n’est pas un en-tête de code d’autorisation (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1282
+#: src/scm/webid-oidc/errors.scm:1300
 #, scheme-format
 msgid "~s is not an authorization code payload (because ~a)"
 msgstr "~s n’est pas un contenu de code d’autorisation (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1285
+#: src/scm/webid-oidc/errors.scm:1303
 #, scheme-format
 msgid "the current time is ~a, and the authorization code expired at ~a"
 msgstr ""
 "la date est actuellement ~a, et le code d’autorisation a expiré à la date ~a"
 
-#: src/scm/webid-oidc/errors.scm:1289
+#: src/scm/webid-oidc/errors.scm:1307
 #, scheme-format
 msgid "I cannot decode ~s as an authorization code (because ~a)"
 msgstr "je n’ai pas pu décoder ~s comme un code d’autorisation (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1292
+#: src/scm/webid-oidc/errors.scm:1310
 #, scheme-format
 msgid "I cannot encode ~s as an authorization code (because ~a)"
 msgstr "je n’ai pas pu encoder ~s comme un code d’autorisation (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1295
+#: src/scm/webid-oidc/errors.scm:1313
 #, scheme-format
 msgid "there is no such refresh token as ~s"
 msgstr "il n’y a pas de jeton de rafraîchissement ~s"
 
-#: src/scm/webid-oidc/errors.scm:1298
+#: src/scm/webid-oidc/errors.scm:1316
 #, scheme-format
 msgid ""
 "the refresh token is bound to a key confirmed as ~s, but it is used with key "
@@ -587,45 +587,45 @@ msgstr ""
 "Le jeton de rafraîchissement est lié à une clé confirmée par ~s, mais il est "
 "utilisé avec la clé ~s"
 
-#: src/scm/webid-oidc/errors.scm:1301
+#: src/scm/webid-oidc/errors.scm:1319
 #, scheme-format
 msgid "I cannot decode ~s as an ID token (because ~a)"
 msgstr "je n’ai pas pu décoder ~s comme jeton d’identité (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1304
+#: src/scm/webid-oidc/errors.scm:1322
 #, scheme-format
 msgid "I cannot encode ~s as an ID token (because ~a)"
 msgstr "je n’ai pas pu encoder ~s comme un jeton d’identité (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1307
+#: src/scm/webid-oidc/errors.scm:1325
 #, scheme-format
 msgid "the grant type ~s is not supported"
 msgstr "le type d’octroi ~s n’est pas supporté "
 
-#: src/scm/webid-oidc/errors.scm:1310
+#: src/scm/webid-oidc/errors.scm:1328
 msgid "there is no authorization code in the request"
 msgstr "il n’y a pas de code d’autorisation dans la requête"
 
-#: src/scm/webid-oidc/errors.scm:1312
+#: src/scm/webid-oidc/errors.scm:1330
 msgid "there is no refresh token in the request"
 msgstr "il n’y a pas de jeton de rafraîchissement dans la requête"
 
-#: src/scm/webid-oidc/errors.scm:1314
+#: src/scm/webid-oidc/errors.scm:1332
 #, scheme-format
 msgid "~s is not an ID token (because ~a)"
 msgstr "~s n’est pas un jeton d’identité (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1317
+#: src/scm/webid-oidc/errors.scm:1335
 #, scheme-format
 msgid "~s is not an ID token header (because ~a)"
 msgstr "~s n’est pas un en-tête de jeton d’identité (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1320
+#: src/scm/webid-oidc/errors.scm:1338
 #, scheme-format
 msgid "~s is not an ID token payload (because ~a)"
 msgstr "~s n’est pas un contenu de jeton d’identité (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1323
+#: src/scm/webid-oidc/errors.scm:1341
 #, scheme-format
 msgid ""
 "I couldn’t set the locale to ~s as an approximation of the client locale ~s"
@@ -633,12 +633,12 @@ msgstr ""
 "je n’ai pas pu définir la locale à ~s comme approximation de la locale du "
 "client ~s"
 
-#: src/scm/webid-oidc/errors.scm:1326
+#: src/scm/webid-oidc/errors.scm:1344
 #, scheme-format
 msgid "~s does not admit ~s as an identity provider"
 msgstr "~s n’admet pas ~s comme fournisseur d’identité"
 
-#: src/scm/webid-oidc/errors.scm:1329
+#: src/scm/webid-oidc/errors.scm:1347
 #, scheme-format
 msgid ""
 "~a is neither an identity provider (because ~a) nor a webid (because ~a)"
@@ -646,76 +646,76 @@ msgstr ""
 "~a n’est ni un fournisseur d’identité (parce que ~a) ni un webid (parce que "
 "~a)"
 
-#: src/scm/webid-oidc/errors.scm:1334
+#: src/scm/webid-oidc/errors.scm:1352
 #, scheme-format
 msgid "the token request failed (because ~a)"
 msgstr "la requête de jeton a échoué (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1337
+#: src/scm/webid-oidc/errors.scm:1355
 #, scheme-format
 msgid "you don’t have a refresh token for identity ~a certified by ~a in ~s"
 msgstr ""
 "vous n’avez pas de jeton de rafraîchissement pour l’identité ~a certifié par "
 "~a dans ~s"
 
-#: src/scm/webid-oidc/errors.scm:1342
+#: src/scm/webid-oidc/errors.scm:1360
 #, scheme-format
 msgid "all identity provider candidates for ~a failed: ~a"
 msgstr "tous les candidats de fournisseurs d’identité pour ~a ont échoué : ~a"
 
-#: src/scm/webid-oidc/errors.scm:1346
+#: src/scm/webid-oidc/errors.scm:1364
 #, scheme-format
 msgid "~s failed (because ~a)"
 msgstr "~s a échoué (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1349
+#: src/scm/webid-oidc/errors.scm:1367
 msgid ", "
 msgstr ", "
 
-#: src/scm/webid-oidc/errors.scm:1351
+#: src/scm/webid-oidc/errors.scm:1369
 #, scheme-format
 msgid "no resource has been found to serve URI path ~s"
 msgstr "aucune ressource n’a été trouvée pour servir le chemin d’URI ~s"
 
-#: src/scm/webid-oidc/errors.scm:1354
+#: src/scm/webid-oidc/errors.scm:1372
 #, scheme-format
 msgid "the resource kind ~s is absent for the resource at ~s"
 msgstr "le type de ressource ~s est absent pour la ressource ~s"
 
-#: src/scm/webid-oidc/errors.scm:1357
+#: src/scm/webid-oidc/errors.scm:1375
 #, scheme-format
 msgid "no resource has been found to serve URI path ~s, but ~s exists"
 msgstr ""
 "aucune ressource n’a été trouvée pour servir le chemin d’URI ~s, mais ~s "
 "existe"
 
-#: src/scm/webid-oidc/errors.scm:1360
+#: src/scm/webid-oidc/errors.scm:1378
 msgid "the root storage cannot be deleted"
 msgstr "le stockage racine ne peut pas être détruit"
 
-#: src/scm/webid-oidc/errors.scm:1362
+#: src/scm/webid-oidc/errors.scm:1380
 #, scheme-format
 msgid "the container ~s should be emptied before being deleted"
 msgstr "le conteneur ~s doit être vidé avant d’être détruit"
 
-#: src/scm/webid-oidc/errors.scm:1365
+#: src/scm/webid-oidc/errors.scm:1383
 #, scheme-format
 msgid "the group ~s cannot be fetched (because ~a)"
 msgstr "le groupe ~s n’a pas pu être récupéré (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:1369
+#: src/scm/webid-oidc/errors.scm:1387
 #, scheme-format
 msgid "the containment triples in the request to update ~s are not up to date"
 msgstr ""
 "les triplets de contention dans la requête pour changer ~s ne sont pas à jour"
 
-#: src/scm/webid-oidc/errors.scm:1372
+#: src/scm/webid-oidc/errors.scm:1390
 #, scheme-format
 msgid "the server cannot process resources with the ~s content-type"
 msgstr ""
 "le serveur ne peut pas traiter des ressources avec le type de contenu ~s"
 
-#: src/scm/webid-oidc/errors.scm:1375
+#: src/scm/webid-oidc/errors.scm:1393
 #, scheme-format
 msgid ""
 "the client wants to create a resource at ~s, which is reserved for an "
@@ -724,7 +724,7 @@ msgstr ""
 "le client veut créer une ressource en tant que ~s, qui est réservé pour une "
 "ressource auxiliare"
 
-#: src/scm/webid-oidc/errors.scm:1378
+#: src/scm/webid-oidc/errors.scm:1396
 #, scheme-format
 msgid ""
 "the operation on ~s by ~s is refused, because it’s not by ~s and the access "
@@ -733,70 +733,88 @@ msgstr ""
 "l’opération sur ~s par ~s est refusée, parce que ce n’est pas ~s et le "
 "contrôle d’accès refuse le mode d’opération suivant : ~s"
 
-#: src/scm/webid-oidc/errors.scm:1384
+#: src/scm/webid-oidc/errors.scm:1401
+#, scheme-format
+msgid ""
+"the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
+"resource has a representation of ~s"
+msgstr ""
+"la précondition du client a échoué pour ~s : elle autorise ~s, interdit ~s, "
+"mais la ressource a une représentation ~s"
+
+#: src/scm/webid-oidc/errors.scm:1403
+#, scheme-format
+msgid ""
+"the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
+"resource has no representation"
+msgstr ""
+"la précondition du client a échoué pour ~s : elle autorise ~s, interdit ~s, "
+"mais la ressource n’a pas de représentation"
+
+#: src/scm/webid-oidc/errors.scm:1408
 msgid "that’s it"
 msgstr "c’est tout"
 
-#: src/scm/webid-oidc/errors.scm:1388
+#: src/scm/webid-oidc/errors.scm:1412
 #, scheme-format
 msgid "~a and ~a"
 msgstr "~a et ~a"
 
-#: src/scm/webid-oidc/errors.scm:1391
+#: src/scm/webid-oidc/errors.scm:1415
 #, scheme-format
 msgid "~a, ~a"
 msgstr "~a, ~a"
 
-#: src/scm/webid-oidc/errors.scm:1395
+#: src/scm/webid-oidc/errors.scm:1419
 #, scheme-format
 msgid "the signature ~a does not match key ~s with payload ~a"
 msgstr "la signature ~a ne correspond pas à la clé ~s avec le contenu ~a"
 
-#: src/scm/webid-oidc/errors.scm:1398
+#: src/scm/webid-oidc/errors.scm:1422
 msgid "there is an undefined variable"
 msgstr "il y a une variable non définie"
 
-#: src/scm/webid-oidc/errors.scm:1400
+#: src/scm/webid-oidc/errors.scm:1424
 #, scheme-format
 msgid "the origin is ~a"
 msgstr "l’origine est ~a"
 
-#: src/scm/webid-oidc/errors.scm:1403
+#: src/scm/webid-oidc/errors.scm:1427
 #, scheme-format
 msgid "a message is attached: ~a"
 msgstr "un message est attaché : ~a"
 
-#: src/scm/webid-oidc/errors.scm:1406
+#: src/scm/webid-oidc/errors.scm:1430
 #, scheme-format
 msgid "the values ~s are problematic"
 msgstr "les valeurs ~s sont problématiques"
 
-#: src/scm/webid-oidc/errors.scm:1409
+#: src/scm/webid-oidc/errors.scm:1433
 msgid "there is a kind and args"
 msgstr "il y a un type et des arguments"
 
-#: src/scm/webid-oidc/errors.scm:1411
+#: src/scm/webid-oidc/errors.scm:1435
 msgid "there is an assertion failure"
 msgstr "il y a un échec d’assertion"
 
-#: src/scm/webid-oidc/errors.scm:1413
+#: src/scm/webid-oidc/errors.scm:1437
 #, scheme-format
 msgid "the program quits with code ~a"
 msgstr "le programme quitte avec le code ~a"
 
-#: src/scm/webid-oidc/errors.scm:1416
+#: src/scm/webid-oidc/errors.scm:1440
 msgid "the program cannot recover from this exception"
 msgstr "le programme ne peut pas récupérer après cette exception"
 
-#: src/scm/webid-oidc/errors.scm:1418
+#: src/scm/webid-oidc/errors.scm:1442
 msgid "there is an external error"
 msgstr "il y a une erreur externe"
 
-#: src/scm/webid-oidc/errors.scm:1420
+#: src/scm/webid-oidc/errors.scm:1444
 msgid "there is an error"
 msgstr "il y a une erreur"
 
-#: src/scm/webid-oidc/errors.scm:1422
+#: src/scm/webid-oidc/errors.scm:1446
 #, scheme-format
 msgid "Unhandled exception type ~a."
 msgstr "Type d’exception non pris en charge ~a."
diff --git a/po/webid-oidc.pot b/po/webid-oidc.pot
index 9812c8a..e6682c9 100644
--- a/po/webid-oidc.pot
+++ b/po/webid-oidc.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-06-19 11:40+0200\n"
+"POT-Creation-Date: 2021-06-27 00:19+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -122,652 +122,666 @@ msgstr ""
 msgid "Usage: generate-key [NUMBER OF BITS | CURVE]\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1013
+#: src/scm/webid-oidc/errors.scm:1031
 msgid "that’s how it is"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1018
+#: src/scm/webid-oidc/errors.scm:1036
 #, scheme-format
 msgid "the value ~s is not a base64 string (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1021
+#: src/scm/webid-oidc/errors.scm:1039
 #, scheme-format
 msgid "the value ~s is not JSON (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1024
+#: src/scm/webid-oidc/errors.scm:1042
 #, scheme-format
 msgid "the value ~s is not Turtle (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1027
+#: src/scm/webid-oidc/errors.scm:1045
 #, scheme-format
 msgid "the value ~s does not identify an elleptic curve"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1032
+#: src/scm/webid-oidc/errors.scm:1050
 #, scheme-format
 msgid "the value ~s does not identify a JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1034
+#: src/scm/webid-oidc/errors.scm:1052
 #, scheme-format
 msgid "the value ~s does not identify a JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1039
+#: src/scm/webid-oidc/errors.scm:1057
 #, scheme-format
 msgid "the value ~s does not identify a public JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1041
+#: src/scm/webid-oidc/errors.scm:1059
 #, scheme-format
 msgid "the value ~s does not identify a public JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1046
+#: src/scm/webid-oidc/errors.scm:1064
 #, scheme-format
 msgid "the value ~s does not identify a private JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1048
+#: src/scm/webid-oidc/errors.scm:1066
 #, scheme-format
 msgid "the value ~s does not identify a private JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1053
+#: src/scm/webid-oidc/errors.scm:1071
 #, scheme-format
 msgid "the value ~s does not identify a JWKS (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1055
+#: src/scm/webid-oidc/errors.scm:1073
 #, scheme-format
 msgid "the value ~s does not identify a JWKS"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1058
+#: src/scm/webid-oidc/errors.scm:1076
 #, scheme-format
 msgid "the value ~s does not identify a hash algorithm"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1061
+#: src/scm/webid-oidc/errors.scm:1079
 #, scheme-format
 msgid "the value ~s is not an alist or misses key ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1064
+#: src/scm/webid-oidc/errors.scm:1082
 #, scheme-format
 msgid "the value ~s is not a JWS header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1067
+#: src/scm/webid-oidc/errors.scm:1085
 #, scheme-format
 msgid "the value ~s is not a JWS payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1070
+#: src/scm/webid-oidc/errors.scm:1088
 #, scheme-format
 msgid "the value ~s is not a JWS (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1073
+#: src/scm/webid-oidc/errors.scm:1091
 #, scheme-format
 msgid "the string ~s cannot be split in 3 parts with ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1076
+#: src/scm/webid-oidc/errors.scm:1094
 #, scheme-format
 msgid ""
 "all key candidates failed to verify signature ~s with algorithm ~s and "
 "payload ~a (there were ~a: ~s)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1079
+#: src/scm/webid-oidc/errors.scm:1097
 #, scheme-format
 msgid "I cannot decode JWS ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1082
+#: src/scm/webid-oidc/errors.scm:1100
 #, scheme-format
 msgid "I cannot encode JWS ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1085
+#: src/scm/webid-oidc/errors.scm:1103
 #, scheme-format
 msgid ""
 "the server request unexpectedly failed with code ~a and reason phrase ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1090
+#: src/scm/webid-oidc/errors.scm:1108
 #, scheme-format
 msgid "the header ~a should not have the value ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1092
+#: src/scm/webid-oidc/errors.scm:1110
 #, scheme-format
 msgid "the header ~a should be present"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1095
+#: src/scm/webid-oidc/errors.scm:1113
 #, scheme-format
 msgid "the server response wasn't expected: ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1101
+#: src/scm/webid-oidc/errors.scm:1119
 #, scheme-format
 msgid "the value ~s is not an OIDC configuration (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1106
+#: src/scm/webid-oidc/errors.scm:1124
 #, scheme-format
 msgid "the webid field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1107
+#: src/scm/webid-oidc/errors.scm:1125
 msgid "the webid field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1111
+#: src/scm/webid-oidc/errors.scm:1129
 #, scheme-format
 msgid "the sub field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1112
+#: src/scm/webid-oidc/errors.scm:1130
 msgid "the sub field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1116
+#: src/scm/webid-oidc/errors.scm:1134
 #, scheme-format
 msgid "the iss field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1117
+#: src/scm/webid-oidc/errors.scm:1135
 msgid "the iss field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1121
+#: src/scm/webid-oidc/errors.scm:1139
 #, scheme-format
 msgid "the aud field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1122
+#: src/scm/webid-oidc/errors.scm:1140
 msgid "the aud field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1126
+#: src/scm/webid-oidc/errors.scm:1144
 #, scheme-format
 msgid "the iat field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1127
+#: src/scm/webid-oidc/errors.scm:1145
 msgid "the iat field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1131
+#: src/scm/webid-oidc/errors.scm:1149
 #, scheme-format
 msgid "the exp field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1132
+#: src/scm/webid-oidc/errors.scm:1150
 msgid "the exp field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1136
+#: src/scm/webid-oidc/errors.scm:1154
 #, scheme-format
 msgid "the cnf/jkt field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1137
+#: src/scm/webid-oidc/errors.scm:1155
 msgid "the cnf/jkt field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1141
+#: src/scm/webid-oidc/errors.scm:1159
 #, scheme-format
 msgid "the client-id field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1142
+#: src/scm/webid-oidc/errors.scm:1160
 msgid "the client-id field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1146
+#: src/scm/webid-oidc/errors.scm:1164
 #: src/scm/webid-oidc/authorization-page-unsafe.scm:133
 #, scheme-format
 msgid "the redirect_uris field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1147
+#: src/scm/webid-oidc/errors.scm:1165
 #: src/scm/webid-oidc/authorization-page-unsafe.scm:134
 msgid "the redirect_uris field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1151
+#: src/scm/webid-oidc/errors.scm:1169
 #, scheme-format
 msgid "the typ field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1152
+#: src/scm/webid-oidc/errors.scm:1170
 msgid "the typ field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1156
+#: src/scm/webid-oidc/errors.scm:1174
 #, scheme-format
 msgid "the jwk field is incorrect: ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1158
+#: src/scm/webid-oidc/errors.scm:1176
 msgid "the jwk field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1162
+#: src/scm/webid-oidc/errors.scm:1180
 #, scheme-format
 msgid "the jti field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1163
+#: src/scm/webid-oidc/errors.scm:1181
 msgid "the jti field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1167
+#: src/scm/webid-oidc/errors.scm:1185
 #, scheme-format
 msgid "the nonce field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1168
+#: src/scm/webid-oidc/errors.scm:1186
 msgid "the nonce field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1172
+#: src/scm/webid-oidc/errors.scm:1190
 #, scheme-format
 msgid "the htm field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1173
+#: src/scm/webid-oidc/errors.scm:1191
 msgid "the htm field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1177
+#: src/scm/webid-oidc/errors.scm:1195
 #, scheme-format
 msgid "the htu field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1178
+#: src/scm/webid-oidc/errors.scm:1196
 msgid "the htu field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1180
+#: src/scm/webid-oidc/errors.scm:1198
 #, scheme-format
 msgid "~s is not an access token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1183
+#: src/scm/webid-oidc/errors.scm:1201
 #, scheme-format
 msgid "~s is not an access token header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1186
+#: src/scm/webid-oidc/errors.scm:1204
 #, scheme-format
 msgid "~s is not an access token payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1189
+#: src/scm/webid-oidc/errors.scm:1207
 #, scheme-format
 msgid "~s is not a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1192
+#: src/scm/webid-oidc/errors.scm:1210
 #, scheme-format
 msgid "~s is not a DPoP proof header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1195
+#: src/scm/webid-oidc/errors.scm:1213
 #, scheme-format
 msgid "~s is not a DPoP proof payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1198
+#: src/scm/webid-oidc/errors.scm:1216
 #, scheme-format
 msgid "I cannot fetch the issuer configuration of ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1205
+#: src/scm/webid-oidc/errors.scm:1223
 #, scheme-format
 msgid "I cannot fetch the JWKS of ~a at ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1216
+#: src/scm/webid-oidc/errors.scm:1234
 #, scheme-format
 msgid "the HTTP method is signed for ~s, but ~s was requested"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1219
+#: src/scm/webid-oidc/errors.scm:1237
 #, scheme-format
 msgid "the HTTP uri is signed for ~a, but ~a was requested"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1222
+#: src/scm/webid-oidc/errors.scm:1240
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof is signed in the future at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1226
+#: src/scm/webid-oidc/errors.scm:1244
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof was signed too long ago at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1235
+#: src/scm/webid-oidc/errors.scm:1253
 #, scheme-format
 msgid "the key ~s does not hash to ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1237
+#: src/scm/webid-oidc/errors.scm:1255
 #, scheme-format
 msgid "the key confirmation of ~s failed (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1239
+#: src/scm/webid-oidc/errors.scm:1257
 #, scheme-format
 msgid "the key confirmation of ~s failed"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1241
+#: src/scm/webid-oidc/errors.scm:1259
 #, scheme-format
 msgid "the jti ~s has already been found (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1244
+#: src/scm/webid-oidc/errors.scm:1262
 #, scheme-format
 msgid "I cannot decode ~s as an access token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1247
+#: src/scm/webid-oidc/errors.scm:1265
 #, scheme-format
 msgid "I cannot encode ~s as an access token with key ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1250
+#: src/scm/webid-oidc/errors.scm:1268
 #, scheme-format
 msgid "I cannot decode ~s as a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1253
+#: src/scm/webid-oidc/errors.scm:1271
 #, scheme-format
 msgid "I cannot encode ~s as a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1256
+#: src/scm/webid-oidc/errors.scm:1274
 #, scheme-format
 msgid "I could not fetch a RDF graph at ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1259
+#: src/scm/webid-oidc/errors.scm:1277
 #, scheme-format
 msgid "~s is not a client manifest (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1262
+#: src/scm/webid-oidc/errors.scm:1280
 #, scheme-format
 msgid "~s does not authorize redirection URI ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1265
+#: src/scm/webid-oidc/errors.scm:1283
 msgid "I cannot serve a public manifest"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1267
+#: src/scm/webid-oidc/errors.scm:1285
 #, scheme-format
 msgid "~a does not have a client manifest registration triple"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1270
+#: src/scm/webid-oidc/errors.scm:1288
 #, scheme-format
 msgid "the client manifest at ~a is advertised for ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1273
+#: src/scm/webid-oidc/errors.scm:1291
 #, scheme-format
 msgid "I could not fetch the client manifest of ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1276
+#: src/scm/webid-oidc/errors.scm:1294
 #, scheme-format
 msgid "~s is not an authorization code (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1279
+#: src/scm/webid-oidc/errors.scm:1297
 #, scheme-format
 msgid "~s is not an authorization code header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1282
+#: src/scm/webid-oidc/errors.scm:1300
 #, scheme-format
 msgid "~s is not an authorization code payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1285
+#: src/scm/webid-oidc/errors.scm:1303
 #, scheme-format
 msgid "the current time is ~a, and the authorization code expired at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1289
+#: src/scm/webid-oidc/errors.scm:1307
 #, scheme-format
 msgid "I cannot decode ~s as an authorization code (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1292
+#: src/scm/webid-oidc/errors.scm:1310
 #, scheme-format
 msgid "I cannot encode ~s as an authorization code (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1295
+#: src/scm/webid-oidc/errors.scm:1313
 #, scheme-format
 msgid "there is no such refresh token as ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1298
+#: src/scm/webid-oidc/errors.scm:1316
 #, scheme-format
 msgid ""
 "the refresh token is bound to a key confirmed as ~s, but it is used with key "
 "~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1301
+#: src/scm/webid-oidc/errors.scm:1319
 #, scheme-format
 msgid "I cannot decode ~s as an ID token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1304
+#: src/scm/webid-oidc/errors.scm:1322
 #, scheme-format
 msgid "I cannot encode ~s as an ID token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1307
+#: src/scm/webid-oidc/errors.scm:1325
 #, scheme-format
 msgid "the grant type ~s is not supported"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1310
+#: src/scm/webid-oidc/errors.scm:1328
 msgid "there is no authorization code in the request"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1312
+#: src/scm/webid-oidc/errors.scm:1330
 msgid "there is no refresh token in the request"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1314
+#: src/scm/webid-oidc/errors.scm:1332
 #, scheme-format
 msgid "~s is not an ID token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1317
+#: src/scm/webid-oidc/errors.scm:1335
 #, scheme-format
 msgid "~s is not an ID token header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1320
+#: src/scm/webid-oidc/errors.scm:1338
 #, scheme-format
 msgid "~s is not an ID token payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1323
+#: src/scm/webid-oidc/errors.scm:1341
 #, scheme-format
 msgid ""
 "I couldn’t set the locale to ~s as an approximation of the client locale ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1326
+#: src/scm/webid-oidc/errors.scm:1344
 #, scheme-format
 msgid "~s does not admit ~s as an identity provider"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1329
+#: src/scm/webid-oidc/errors.scm:1347
 #, scheme-format
 msgid ""
 "~a is neither an identity provider (because ~a) nor a webid (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1334
+#: src/scm/webid-oidc/errors.scm:1352
 #, scheme-format
 msgid "the token request failed (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1337
+#: src/scm/webid-oidc/errors.scm:1355
 #, scheme-format
 msgid "you don’t have a refresh token for identity ~a certified by ~a in ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1342
+#: src/scm/webid-oidc/errors.scm:1360
 #, scheme-format
 msgid "all identity provider candidates for ~a failed: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1346
+#: src/scm/webid-oidc/errors.scm:1364
 #, scheme-format
 msgid "~s failed (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1349
+#: src/scm/webid-oidc/errors.scm:1367
 msgid ", "
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1351
+#: src/scm/webid-oidc/errors.scm:1369
 #, scheme-format
 msgid "no resource has been found to serve URI path ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1354
+#: src/scm/webid-oidc/errors.scm:1372
 #, scheme-format
 msgid "the resource kind ~s is absent for the resource at ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1357
+#: src/scm/webid-oidc/errors.scm:1375
 #, scheme-format
 msgid "no resource has been found to serve URI path ~s, but ~s exists"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1360
+#: src/scm/webid-oidc/errors.scm:1378
 msgid "the root storage cannot be deleted"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1362
+#: src/scm/webid-oidc/errors.scm:1380
 #, scheme-format
 msgid "the container ~s should be emptied before being deleted"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1365
+#: src/scm/webid-oidc/errors.scm:1383
 #, scheme-format
 msgid "the group ~s cannot be fetched (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1369
+#: src/scm/webid-oidc/errors.scm:1387
 #, scheme-format
 msgid "the containment triples in the request to update ~s are not up to date"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1372
+#: src/scm/webid-oidc/errors.scm:1390
 #, scheme-format
 msgid "the server cannot process resources with the ~s content-type"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1375
+#: src/scm/webid-oidc/errors.scm:1393
 #, scheme-format
 msgid ""
 "the client wants to create a resource at ~s, which is reserved for an "
 "auxiliary resource"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1378
+#: src/scm/webid-oidc/errors.scm:1396
 #, scheme-format
 msgid ""
 "the operation on ~s by ~s is refused, because it’s not by ~s and the access "
 "control forbids the following mode of operation: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1384
+#: src/scm/webid-oidc/errors.scm:1401
+#, scheme-format
+msgid ""
+"the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
+"resource has a representation of ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:1403
+#, scheme-format
+msgid ""
+"the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
+"resource has no representation"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:1408
 msgid "that’s it"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1388
+#: src/scm/webid-oidc/errors.scm:1412
 #, scheme-format
 msgid "~a and ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1391
+#: src/scm/webid-oidc/errors.scm:1415
 #, scheme-format
 msgid "~a, ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1395
+#: src/scm/webid-oidc/errors.scm:1419
 #, scheme-format
 msgid "the signature ~a does not match key ~s with payload ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1398
+#: src/scm/webid-oidc/errors.scm:1422
 msgid "there is an undefined variable"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1400
+#: src/scm/webid-oidc/errors.scm:1424
 #, scheme-format
 msgid "the origin is ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1403
+#: src/scm/webid-oidc/errors.scm:1427
 #, scheme-format
 msgid "a message is attached: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1406
+#: src/scm/webid-oidc/errors.scm:1430
 #, scheme-format
 msgid "the values ~s are problematic"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1409
+#: src/scm/webid-oidc/errors.scm:1433
 msgid "there is a kind and args"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1411
+#: src/scm/webid-oidc/errors.scm:1435
 msgid "there is an assertion failure"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1413
+#: src/scm/webid-oidc/errors.scm:1437
 #, scheme-format
 msgid "the program quits with code ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1416
+#: src/scm/webid-oidc/errors.scm:1440
 msgid "the program cannot recover from this exception"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1418
+#: src/scm/webid-oidc/errors.scm:1442
 msgid "there is an external error"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1420
+#: src/scm/webid-oidc/errors.scm:1444
 msgid "there is an error"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1422
+#: src/scm/webid-oidc/errors.scm:1446
 #, scheme-format
 msgid "Unhandled exception type ~a."
 msgstr ""
diff --git a/src/scm/webid-oidc/errors.scm b/src/scm/webid-oidc/errors.scm
index 80a4f37..5f07644 100644
--- a/src/scm/webid-oidc/errors.scm
+++ b/src/scm/webid-oidc/errors.scm
@@ -1002,6 +1002,24 @@
         forbidden-owner
         forbidden-mode)
 
+(define-exception-type
+  &precondition-failed
+  &external-error
+  make-precondition-failed
+  precondition-failed?
+  (path precondition-failed-path)
+  (if-match precondition-failed-if-match)
+  (if-none-match precondition-failed-if-none-match)
+  (real-etag precondition-failed-real-etag))
+
+(export &precondition-failed
+        make-precondition-failed
+        precondition-failed?
+        precondition-failed-path
+        precondition-failed-if-match
+        precondition-failed-if-none-match
+        precondition-failed-real-etag)
+
 (define*-public (error->str err #:key (max-depth #f))
   (if (record? err)
       (let* ((type (record-type-descriptor err))
@@ -1378,6 +1396,12 @@
            (format #f (G_ "the operation on ~s by ~s is refused, because it’s not by ~s and the access control forbids the following mode of operation: ~s")
                    (get 'path) (uri->string (get 'user)) (uri->string (get 'owner))
                    (uri->string (get 'mode))))
+          ((&precondition-failed)
+           (if (get 'real-etag)
+               (format #f (G_ "the client precondition failed for ~s: it allows for ~s, forbids ~s, but the resource has a representation of ~s")
+                       (get 'path) (get 'if-match) (get 'if-none-match) (get 'real-etag))
+               (format #f (G_ "the client precondition failed for ~s: it allows for ~s, forbids ~s, but the resource has no representation")
+                       (get 'path) (get 'if-match) (get 'if-none-match))))
           ((&compound-exception)
            (let ((components (get 'components)))
              (if (null? components)
diff --git a/src/scm/webid-oidc/server/Makefile.am b/src/scm/webid-oidc/server/Makefile.am
index 2f14df5..f6627e5 100644
--- a/src/scm/webid-oidc/server/Makefile.am
+++ b/src/scm/webid-oidc/server/Makefile.am
@@ -1,9 +1,11 @@
 dist_serverwebidoidcmod_DATA += \
   %reldir%/create.scm \
-  %reldir%/read.scm
+  %reldir%/read.scm \
+  %reldir%/precondition.scm
 
 serverwebidoidcgo_DATA += \
   %reldir%/create.go \
-  %reldir%/read.go
+  %reldir%/read.go \
+  %reldir%/precondition.go
 
 include %reldir%/resource/Makefile.am
diff --git a/src/scm/webid-oidc/server/precondition.scm b/src/scm/webid-oidc/server/precondition.scm
new file mode 100644
index 0000000..94c6ae1
--- /dev/null
+++ b/src/scm/webid-oidc/server/precondition.scm
@@ -0,0 +1,74 @@
+(define-module (webid-oidc server precondition)
+  #:use-module (webid-oidc errors)
+  #:use-module (webid-oidc server resource path)
+  #:use-module (webid-oidc server resource content)
+  #:use-module (webid-oidc cache)
+  #:use-module (webid-oidc fetch)
+  #:use-module (webid-oidc http-link)
+  #:use-module (webid-oidc server resource wac)
+  #:use-module ((webid-oidc stubs) #:prefix stubs:)
+  #:use-module (webid-oidc rdf-index)
+  #:use-module ((webid-oidc refresh-token) #:prefix refresh:)
+  #:use-module (web uri)
+  #:use-module (web client)
+  #:use-module (web response)
+  #:use-module (rdf rdf)
+  #:use-module (turtle tordf)
+  #:use-module (turtle fromrdf)
+  #:use-module (rnrs bytevectors)
+  #:use-module (ice-9 exceptions)
+  #:use-module (ice-9 receive)
+  #:use-module (ice-9 optargs)
+  #:use-module (ice-9 iconv)
+  #:use-module (ice-9 textual-ports)
+  #:use-module (ice-9 binary-ports)
+  #:use-module (ice-9 threads)
+  #:use-module (rnrs bytevectors)
+  #:use-module (oop goops)
+  #:export
+  (
+
+   check-precondition
+
+   ))
+
+(define (the-etag object)
+  ;; Sometimes the user passes a pair as an etag (just like what
+  ;; request-if-match may return).
+  (if (pair? object)
+      (car object)
+      object))
+
+(define (check-if-match if-match real-etag)
+  ;; if-match is #f if no filter is used
+  (or (not if-match)
+      (eq? if-match '*)
+      (let check-rest ((precondition if-match))
+        (and (not (null? precondition))
+             (let ((first (the-etag (car precondition)))
+                   (rest (cdr precondition)))
+               (or (equal? first real-etag)
+                   (check-rest rest)))))))
+
+(define (check-if-none-match if-none-match real-etag)
+  ;; if-none-match is #f if there is no filter
+  (or (not if-none-match)
+      (if (eq? if-none-match '*)
+          (not real-etag)
+          ;; if-none-match is a list
+          (let check-rest ((forbidden if-none-match))
+            (or (null? forbidden)
+                (let ((first (the-etag (car forbidden)))
+                      (rest (cdr forbidden)))
+                  (and (not (equal? first real-etag))
+                       (check-rest rest))))))))
+
+(define (check-precondition path if-match if-none-match real-etag)
+  (unless (and (check-if-match if-match real-etag)
+               (check-if-none-match if-none-match real-etag))
+    (let ((error
+           (make-precondition-failed path if-match if-none-match real-etag)))
+      (unless real-etag
+        (set! error
+              (make-exception error (make-path-not-found path))))
+      (raise-exception error))))
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 2a4c5b7..1a6242d 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -45,7 +45,8 @@ TESTS = %reldir%/load-library.scm \
   %reldir%/server-path.scm \
   %reldir%/http-link.scm \
   %reldir%/acl.scm \
-  %reldir%/crud.scm
+  %reldir%/crud.scm \
+  %reldir%/preconditions.scm
 
 EXTRA_DIST += $(TESTS) %reldir%/ChangeLog
 
diff --git a/tests/preconditions.scm b/tests/preconditions.scm
new file mode 100644
index 0000000..01cbd1c
--- /dev/null
+++ b/tests/preconditions.scm
@@ -0,0 +1,69 @@
+(use-modules (webid-oidc server precondition)
+             (webid-oidc errors)
+             (webid-oidc testing)
+             (web http)
+             (web request)
+             (web response)
+             (web uri)
+             (ice-9 receive)
+             (rnrs bytevectors))
+
+(with-test-environment
+ "preconditions"
+ (lambda ()
+   (check-precondition "/whatever" #f #f #f)
+   (check-precondition "/whatever" #f #f "etag")
+   (check-precondition "/whatever" '* #f "etag")
+   (check-precondition "/whatever" '* '() "etag")
+   (check-precondition "/whatever" #f '("other") "etag")
+   (check-precondition "/whatever" '("one" "etag" "or" "another") '() "etag")
+   (with-exception-handler
+       (lambda (error)
+         (unless (precondition-failed? error)
+           (exit 1)))
+     (lambda ()
+       (check-precondition "/whatever" '("etag") '("etag") "etag"))
+     #:unwind? #t
+     #:unwind-for-type &precondition-failed)
+   (with-exception-handler
+       (lambda (error)
+         (unless (precondition-failed? error)
+           (exit 1)))
+     (lambda ()
+       (check-precondition "/whatever" '("etag") '* "etag"))
+     #:unwind? #t
+     #:unwind-for-type &precondition-failed)
+   (with-exception-handler
+       (lambda (error)
+         (unless (precondition-failed? error)
+           (exit 1)))
+     (lambda ()
+       (check-precondition "/whatever" '("nope") '() "etag"))
+     #:unwind? #t
+     #:unwind-for-type &precondition-failed)
+   (with-exception-handler
+       (lambda (error)
+         (unless (precondition-failed? error)
+           (exit 1)))
+     (lambda ()
+       (check-precondition "/whatever" '("nope") '() "etag"))
+     #:unwind? #t
+     #:unwind-for-type &precondition-failed)
+   (with-exception-handler
+       (lambda (error)
+         (unless (precondition-failed? error)
+           (exit 1)))
+     (lambda ()
+       (check-precondition "/whatever" '* #f #f))
+     #:unwind? #t
+     #:unwind-for-type &precondition-failed)
+   (with-exception-handler
+       (lambda (error)
+         (unless (precondition-failed? error)
+           (exit 1)))
+     (lambda ()
+       (check-precondition "/whatever" '() #f #f))
+     #:unwind? #t
+     #:unwind-for-type &precondition-failed)
+   (check-precondition "/whatever" #f '* #f)
+   (check-precondition "/whatever" #f '() #f)))