broadcast_auth/
error.rs

1//! Error type for the shared auth layer.
2
3/// Result alias for the crate's fallible operations.
4pub type Result<T> = core::result::Result<T, Error>;
5
6/// Errors produced by challenge parsing / response computation.
7#[non_exhaustive]
8#[derive(Debug, thiserror::Error)]
9pub enum Error {
10    /// The `WWW-Authenticate` challenge value could not be parsed (RFC 7235 /
11    /// RFC 2326 §14 for a Basic or Digest challenge).
12    #[error("failed to parse challenge: {0}")]
13    ChallengeParse(String),
14
15    /// The `Authorization` response value could not be computed from the
16    /// parsed challenge and credentials (e.g. an unsupported Digest
17    /// `algorithm`/`qop`).
18    #[error("failed to compute Authorization response: {0}")]
19    ResponseCompute(String),
20
21    /// [`crate::SignedUrlKeySet::new`] rejected a key whose secret is shorter
22    /// than the required minimum (issue #747) — a setup-time error, never
23    /// returned from request verification. The `kid` is included since this
24    /// is a config-diagnostic error, not an attacker-facing one.
25    #[error("signed-url key {kid:?} has a {actual}-byte secret, must be at least {min} bytes")]
26    SignedUrlKeyTooShort {
27        /// The offending key's id.
28        kid: String,
29        /// The required minimum secret length in bytes.
30        min: usize,
31        /// The offending secret's actual length in bytes.
32        actual: usize,
33    },
34
35    /// [`crate::SignedUrlKeySet::sign`] was asked to mint a token for a `kid`
36    /// the keyset has no secret for. Only reachable from the *signing* helper
37    /// (used by tests/operators minting URLs) — never from
38    /// [`crate::Verifier::verify`], which folds every signed-URL rejection
39    /// reason into the same [`crate::AuthResult::Unauthorized`] (see that
40    /// module's docs).
41    #[error("signed-url keyset has no key with kid {0:?}")]
42    UnknownSignedUrlKeyId(String),
43}
broadcast_auth/error.rs

broadcast_auth/
error.rs
