cf-modkit-auth 0.5.0

ModKit authentication library
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

use thiserror::Error;

/// Errors that can occur during JWT claims validation and processing
#[derive(Debug, Error)]
pub enum ClaimsError {
    #[error("Invalid signature or key")]
    InvalidSignature,

    #[error("Invalid issuer: expected one of {expected:?}, got {actual}")]
    InvalidIssuer {
        expected: Vec<String>,
        actual: String,
    },

    #[error("Invalid audience: expected one of {expected:?}, got {actual:?}")]
    InvalidAudience {
        expected: Vec<String>,
        actual: Vec<String>,
    },

    #[error("Token expired")]
    Expired,

    #[error("Token not yet valid (nbf check failed)")]
    NotYetValid,

    #[error("Malformed claims: {0}")]
    Malformed(String),

    #[error("Provider error: {0}")]
    Provider(String),

    #[error("Missing required claim: {0}")]
    MissingClaim(String),

    #[error("Invalid claim format: {field} - {reason}")]
    InvalidClaimFormat { field: String, reason: String },

    #[error("Unknown key ID after refresh")]
    UnknownKidAfterRefresh,

    #[error("JWT decode failed: {0}")]
    DecodeFailed(String),

    #[error("JWKS fetch failed: {0}")]
    JwksFetchFailed(String),

    #[error("Unknown key ID: {0}")]
    UnknownKeyId(String),
}

// Conversion from ClaimsError to AuthError for backward compatibility
impl From<ClaimsError> for crate::errors::AuthError {
    fn from(err: ClaimsError) -> Self {
        match err {
            ClaimsError::Expired => crate::errors::AuthError::TokenExpired,
            ClaimsError::InvalidSignature => {
                crate::errors::AuthError::InvalidToken("Invalid signature".into())
            }
            ClaimsError::InvalidIssuer { expected, actual } => {
                crate::errors::AuthError::IssuerMismatch {
                    expected: expected.join(", "),
                    actual,
                }
            }
            ClaimsError::InvalidAudience { expected, actual } => {
                crate::errors::AuthError::AudienceMismatch { expected, actual }
            }
            ClaimsError::JwksFetchFailed(msg) => crate::errors::AuthError::JwksFetchFailed(msg),
            other => crate::errors::AuthError::ValidationFailed(other.to_string()),
        }
    }
}