faucet_cli/
error.rs

1//! CLI-level error type. Wraps every failure mode the binary surfaces so
2//! `main()` can render a single, user-readable line per failure.
3
4use std::path::PathBuf;
5use thiserror::Error;
6
7/// Convenience alias used by every CLI module.
8pub type CliResult<T> = Result<T, CliError>;
9
10/// Top-level error variants for the `faucet` binary.
11#[derive(Debug, Error)]
12pub enum CliError {
13    /// Failed to read a config file from disk.
14    #[error("failed to read config file '{path}': {source}")]
15    ReadConfig {
16        path: PathBuf,
17        #[source]
18        source: std::io::Error,
19    },
20
21    /// The config file extension is neither `.yaml`/`.yml` nor `.json`.
22    #[error(
23        "unsupported config extension for '{path}' — use .yaml, .yml, or .json (mixed JSON/YAML in a single file is not allowed)"
24    )]
25    UnknownExtension { path: PathBuf },
26
27    /// Failed to parse the raw config text after interpolation.
28    #[error("failed to parse config '{path}': {message}")]
29    ParseConfig { path: PathBuf, message: String },
30
31    /// An `${env:VAR}` reference could not be resolved.
32    #[error("missing environment variable '{var}' referenced in config at '{location}'")]
33    MissingEnvVar { var: String, location: String },
34
35    /// A `${file:PATH}` reference could not be read.
36    #[error("failed to read interpolated file '{}' referenced in config: {source}", path.display())]
37    ReadInterpolatedFile {
38        path: PathBuf,
39        #[source]
40        source: std::io::Error,
41    },
42
43    #[error(
44        "interpolated file '{}' exceeds the {max_bytes}-byte limit for `${{file:...}}` — \
45         this directive is for small token/secret files, not bulk data",
46        path.display()
47    )]
48    InterpolatedFileTooLarge { path: PathBuf, max_bytes: u64 },
49
50    /// A `${row_id.path}` token referenced an unknown matrix row id at
51    /// expand-time (or a typo'd load-time prefix that survived to record-time).
52    #[error(
53        "interpolation '{token}' references unknown id '{id}' (must be a matrix row id, or one of env/file/secret)"
54    )]
55    UnknownInterpolationId { id: String, token: String },
56
57    /// A `${row_id.path}` resolved at record-time, but the dotted path doesn't
58    /// match any field in the parent record.
59    #[error("matrix row '{id}' has no field at path '{path}' in this parent record")]
60    MissingRecordField { id: String, path: String },
61
62    /// The named connector is unknown (or its feature flag is disabled in this build).
63    #[error("unknown {kind} '{name}'. Available: {available}")]
64    UnknownConnector {
65        kind: &'static str,
66        name: String,
67        available: String,
68    },
69
70    /// The state-store type referenced in the config is unknown or not compiled in.
71    #[error("unknown state store '{name}'. Available: {available}")]
72    UnknownStateStore { name: String, available: String },
73
74    /// A transform type referenced in the config is not recognised.
75    #[error("unknown transform '{name}'. Available: {available}")]
76    UnknownTransform { name: String, available: String },
77
78    /// The transform config block could not be deserialized into the expected shape.
79    #[error("invalid transform '{name}': {message}")]
80    InvalidTransform { name: String, message: String },
81
82    /// A connector config object failed to deserialize.
83    #[error("invalid config for {kind} '{name}': {message}")]
84    InvalidConnectorConfig {
85        kind: &'static str,
86        name: String,
87        message: String,
88    },
89
90    /// A scaffold target already exists.
91    #[error("refusing to overwrite existing file '{path}' — pass --force to overwrite")]
92    ScaffoldExists { path: PathBuf },
93
94    /// The CLI was invoked with `--from-env` but the required selector env var
95    /// (`FAUCET_SOURCE` or `FAUCET_SINK`) is unset.
96    #[error(
97        "missing required environment variable '{var}' — set it before invoking `faucet run --from-env`"
98    )]
99    MissingEnvSelector { var: String },
100
101    /// An explicit `--env-file` path does not exist on disk.
102    #[error("--env-file path '{}' does not exist", path.display())]
103    EnvFileNotFound { path: PathBuf },
104
105    /// `faucet run` invoked with neither a config path nor `--from-env`, and
106    /// auto-discovery found no `faucet.{yaml,yml,json}` in cwd.
107    #[error(
108        "no pipeline config: pass a path, --from-env, or create faucet.yaml (or .yml/.json) in the current directory"
109    )]
110    NoConfigOrFromEnv,
111
112    /// Both a scalar env var and its `_JSON` counterpart were set for the same field.
113    #[error(
114        "conflicting environment variables for field '{field}': both '{scalar_var}' and '{json_var}' are set — pick one"
115    )]
116    EnvConflict {
117        field: String,
118        scalar_var: String,
119        json_var: String,
120    },
121
122    /// A `*_JSON` env var did not parse as JSON.
123    #[error("environment variable '{var}' is not valid JSON: {message}")]
124    InvalidEnvJson { var: String, message: String },
125
126    /// `FAUCET_TRANSFORM_<N>` indices are not contiguous starting at 1.
127    #[error(
128        "transform env vars must be contiguous starting at FAUCET_TRANSFORM_1; index {missing} is missing"
129    )]
130    TransformIndexGap { missing: u32 },
131
132    /// A matrix row id collides with a load-time interpolation prefix.
133    #[error("matrix row id '{id}' is reserved (env, file, secret, matrix, pipeline)")]
134    ReservedRowId { id: String },
135
136    /// Two matrix rows declared the same id.
137    #[error("duplicate matrix row id '{id}'")]
138    DuplicateRowId { id: String },
139
140    /// A row's `parent:` field names a row that doesn't exist.
141    #[error("matrix row '{id}' references unknown parent '{parent}'")]
142    UnknownParent { id: String, parent: String },
143
144    /// The parent chain contains a cycle.
145    #[error("matrix has a parent cycle through: {}", ids.join(" -> "))]
146    ParentCycle { ids: Vec<String> },
147
148    /// A row's `depends_on:` list names a row that doesn't exist.
149    #[error("matrix row '{id}' depends on unknown row '{depends_on}'")]
150    UnknownDependency { id: String, depends_on: String },
151
152    /// The combined `parent:` + `depends_on:` graph contains a cycle.
153    #[error("matrix has a dependency cycle involving: {}", ids.join(", "))]
154    DependencyCycle { ids: Vec<String> },
155
156    /// Two parent records of the same matrix row resolved to the same
157    /// `parent_key` value, producing a colliding state-key suffix.
158    #[error(
159        "duplicate state key '{state_key}' for matrix row '{id}': two parent records resolve to the same `parent_key` value — choose a `parent_key` that is unique per record"
160    )]
161    DuplicateStateKey { id: String, state_key: String },
162
163    /// The state key derived from the pipeline name + row id (+ resolved
164    /// parent-key value) is not a valid state-store key. Caught up front at
165    /// unit construction rather than mid-run.
166    #[error("invalid state key '{state_key}' for row '{id}': {reason}")]
167    InvalidStateKey {
168        id: String,
169        state_key: String,
170        reason: String,
171    },
172
173    /// One or more matrix invocations failed under `on_error: continue`.
174    #[error("{count} pipeline invocation(s) failed (see logs above for details)")]
175    PipelineHadFailures { count: usize },
176
177    /// DLQ sink kind is not registered (not compiled in or feature disabled).
178    #[error("DLQ sink kind `{kind}` is not registered (in {context})")]
179    UnknownDlqSinkKind { kind: String, context: String },
180
181    /// DLQ budget field is set to zero (which is invalid; omit to mean 'unlimited').
182    #[error("DLQ {field} must be > 0 (got 0); omit the field to mean 'unlimited'")]
183    InvalidDlqBudget { field: &'static str },
184
185    /// A matrix row referenced a named template that doesn't exist in
186    /// `pipeline.sources` / `pipeline.sinks` (or the legacy `default`).
187    #[error(
188        "matrix row '{row_id}' references unknown {kind} template '{name}'. Known {kind} templates: {known}",
189        known = if known.is_empty() { String::from("(none defined)") } else { known.join(", ") }
190    )]
191    UnknownTemplate {
192        kind: &'static str,
193        name: String,
194        row_id: String,
195        known: Vec<String>,
196    },
197
198    /// A matrix row supplied no `ref:` and the legacy `default` template
199    /// doesn't exist either.
200    #[error(
201        "matrix row '{row_id}' has no {kind}: either set `{kind}: {{ ref: <name> }}` pointing at a `pipeline.{kind}s` template, or declare a legacy `pipeline.{kind}` block"
202    )]
203    MissingTemplate { kind: &'static str, row_id: String },
204
205    /// Both the legacy `pipeline.source` and `pipeline.sources.default` were
206    /// declared (same for sinks). The `default` slot can only be defined once.
207    #[error(
208        "{kind} template '{name}' is defined twice — declare it either via the singular `pipeline.{kind}` block or in `pipeline.{kind}s`, not both"
209    )]
210    DuplicateTemplate { kind: &'static str, name: String },
211
212    /// A sink template carries a `transforms:` field, which only sources support.
213    #[error(
214        "sink template '{name}' has `transforms:` — sinks cannot carry transforms; \
215         declare transforms on the source template, pipeline, or matrix row instead"
216    )]
217    TransformsOnSink { name: String },
218
219    /// A sink template carries `inherit_transforms:`, which only sources support.
220    #[error(
221        "sink template '{name}' has `inherit_transforms:` — sinks cannot carry the \
222         transform-inheritance flag; remove it"
223    )]
224    InheritTransformsOnSink { name: String },
225
226    /// A cycle was detected resolving `${vars.X}` / `${sources.X.PATH}` /
227    /// `${sinks.X.PATH}` references at load time.
228    #[error("interpolation cycle: {}", chain.join(" -> "))]
229    InterpolationCycle { chain: Vec<String> },
230
231    /// A config-composition include/extends chain contains a cycle.
232    #[error("config composition cycle: {}", chain.join(" -> "))]
233    CompositionCycle { chain: Vec<String> },
234
235    /// An `extends`/`!include` target file does not exist.
236    #[error(
237        "config composition: file '{}' referenced by '{}' not found",
238        path.display(),
239        referenced_by.display()
240    )]
241    IncludeNotFound {
242        path: PathBuf,
243        referenced_by: PathBuf,
244    },
245
246    /// Composition nesting exceeded the safety cap (extends/!include loop guard).
247    #[error(
248        "config composition nested deeper than {max} levels — check for an extends/!include loop"
249    )]
250    CompositionDepthExceeded { max: usize },
251
252    /// An `!include` tag had a non-string payload, an unsupported tag, or its
253    /// target failed structural checks.
254    #[error("invalid `!include` in '{}': {reason}", path.display())]
255    BadInclude { path: PathBuf, reason: String },
256
257    /// `--profile NAME` (or FAUCET_PROFILE) named a profile not declared under `profiles:`.
258    #[error(
259        "unknown profile '{name}'. Declared profiles: {}",
260        if known.is_empty() { String::from("(none — no `profiles:` block)") } else { known.join(", ") }
261    )]
262    UnknownProfile { name: String, known: Vec<String> },
263
264    /// A `${vars.X}` token referenced an undefined var.
265    #[error(
266        "interpolation '{token}' references unknown var '{name}' (define it under top-level `vars:`)"
267    )]
268    UnknownVarsRef { name: String, token: String },
269
270    /// A `${sources.X.PATH}` or `${sinks.X.PATH}` token referenced an
271    /// undefined template, or a dotted path that doesn't resolve inside it.
272    #[error("interpolation '{token}' could not be resolved: {reason}")]
273    UnknownTemplateRef { token: String, reason: String },
274
275    /// A connector's `auth: { ref }` named a provider not declared in the
276    /// top-level `auth:` catalog.
277    #[error(
278        "auth references unknown provider '{name}'. Declared providers: {}",
279        if known.is_empty() { String::from("(none)") } else { known.join(", ") }
280    )]
281    UnknownAuthProvider { name: String, known: Vec<String> },
282
283    /// A top-level `auth:` provider spec failed to build.
284    #[error("failed to build auth provider '{name}': {message}")]
285    AuthProviderBuild { name: String, message: String },
286
287    /// A config-level validation failure that isn't covered by a more specific
288    /// variant (e.g. an invalid `quality:` block, or a quality check that
289    /// requires a DLQ when none is configured).
290    #[error("config error: {0}")]
291    Config(String),
292
293    /// Pass-through for failures bubbling up from `faucet-core` or a connector.
294    #[error(transparent)]
295    Faucet(#[from] faucet_core::FaucetError),
296
297    /// Pass-through I/O error.
298    #[error("io error: {0}")]
299    Io(#[from] std::io::Error),
300
301    /// Observability stack (Prometheus / tracing) failed to install.
302    #[error("observability install failed: {0}")]
303    Observability(String),
304
305    /// An internal invariant was violated (a bug). Surfaced instead of
306    /// silently producing a partial result.
307    #[error("internal error: {0}")]
308    Internal(String),
309
310    /// A secret-manager directive used a scheme whose backend feature was not
311    /// compiled into this binary.
312    #[error(
313        "secret directive uses scheme '{scheme}' but this binary was built without \
314         the `secrets-{scheme}` feature — rebuild with `--features secrets-{scheme}` (or `secrets`)"
315    )]
316    SecretBackendDisabled { scheme: String },
317
318    /// The secrets manager has no secret at the given reference.
319    #[error("secret '{reference}' not found in {scheme}")]
320    SecretNotFound { scheme: String, reference: String },
321
322    /// The secret fetch failed (network / API error).
323    #[error("failed to fetch secret '{reference}' from {scheme}: {source}")]
324    SecretFetchFailed {
325        scheme: String,
326        reference: String,
327        #[source]
328        source: Box<dyn std::error::Error + Send + Sync>,
329    },
330
331    /// No ambient credentials were available for the backend.
332    #[error("could not authenticate to {scheme}: {hint}")]
333    SecretAuthFailed { scheme: String, hint: String },
334
335    /// A `#field` selector was used on a secret that is not JSON.
336    #[error("secret '{reference}' from {scheme} is not JSON, but a '#field' selector was used")]
337    SecretNotJson { scheme: String, reference: String },
338
339    /// A `#field` selector named a key absent from the secret JSON.
340    #[error(
341        "secret '{reference}' from {scheme} has no field '{field}' (available: {})",
342        if available.is_empty() { String::from("(none — secret is an empty object)") } else { available.join(", ") }
343    )]
344    SecretFieldMissing {
345        scheme: String,
346        reference: String,
347        field: String,
348        available: Vec<String>,
349    },
350
351    /// A secret directive was found while loading via the synchronous path.
352    #[error(
353        "config references a secrets manager (${{vault:…}} / ${{aws-sm:…}} / …) which requires \
354         the async load path — load via `faucet run`/`validate`/`preview` rather than the sync API"
355    )]
356    SecretsRequireAsyncLoad,
357
358    /// One or more `faucet doctor` preflight probes failed. The checklist is
359    /// printed by the command; `main` maps this to an exit code equal to the
360    /// failed-probe count (clamped to 255).
361    #[error("{failed} preflight probe(s) failed")]
362    DoctorFailed { failed: usize },
363
364    /// One or more `faucet test` cases failed. The report is printed by the
365    /// command; `main` maps this to an exit code equal to the failed-case
366    /// count (clamped to 255).
367    #[error("{failed} test case(s) failed")]
368    TestsFailed { failed: usize },
369
370    /// One or more `faucet backfill` units failed. The per-unit report is
371    /// printed by the command (progress is already durably recorded, so
372    /// `--resume` retries only the failures); `main` maps this to an exit
373    /// code equal to the failed-unit count (clamped to 255).
374    #[error("{failed} backfill unit(s) failed")]
375    BackfillFailed { failed: usize },
376
377    /// A `faucet serve` startup or runtime failure (bind, auth gate, etc.).
378    #[error("serve error: {0}")]
379    Serve(String),
380
381    /// `overlap_policy: forbid` saw a tick fire while a run was still in flight.
382    #[error("scheduled run overlap with overlap_policy: forbid — previous run still in progress")]
383    ScheduleOverlapForbidden,
384}
385
386impl From<faucet_core::InstallError> for CliError {
387    fn from(e: faucet_core::InstallError) -> Self {
388        CliError::Observability(e.to_string())
389    }
390}
391
392#[cfg(test)]
393mod secrets_error_tests {
394    use super::*;
395
396    #[test]
397    fn secret_errors_render_reference_not_value() {
398        let e = CliError::SecretNotFound {
399            scheme: "vault".into(),
400            reference: "secret/data/app#token".into(),
401        };
402        let msg = e.to_string();
403        assert!(msg.contains("vault"));
404        assert!(msg.contains("secret/data/app#token"));
405
406        let e = CliError::SecretFieldMissing {
407            scheme: "aws-sm".into(),
408            reference: "prod/db".into(),
409            field: "password".into(),
410            available: vec!["username".into(), "host".into()],
411        };
412        let msg = e.to_string();
413        assert!(msg.contains("password"));
414        assert!(msg.contains("username") && msg.contains("host"));
415
416        let e = CliError::SecretBackendDisabled {
417            scheme: "azure-kv".into(),
418        };
419        assert!(e.to_string().contains("secrets-azure-kv"));
420
421        assert!(
422            CliError::SecretsRequireAsyncLoad
423                .to_string()
424                .contains("async")
425        );
426    }
427
428    #[test]
429    fn fetch_auth_notjson_errors_render_safely() {
430        let e = CliError::SecretFetchFailed {
431            scheme: "vault".into(),
432            reference: "secret/data/app#token".into(),
433            source: "connection refused".into(),
434        };
435        let msg = e.to_string();
436        assert!(msg.contains("vault") && msg.contains("secret/data/app#token"));
437
438        let e = CliError::SecretAuthFailed {
439            scheme: "aws-sm".into(),
440            hint: "set AWS_PROFILE".into(),
441        };
442        assert!(e.to_string().contains("aws-sm") && e.to_string().contains("set AWS_PROFILE"));
443
444        let e = CliError::SecretNotJson {
445            scheme: "vault".into(),
446            reference: "secret/raw".into(),
447        };
448        assert!(e.to_string().contains("not JSON"));
449    }
450
451    #[test]
452    fn field_missing_with_empty_available_has_no_dangling_list() {
453        let e = CliError::SecretFieldMissing {
454            scheme: "vault".into(),
455            reference: "secret/data/app".into(),
456            field: "token".into(),
457            available: vec![],
458        };
459        let msg = e.to_string();
460        assert!(!msg.ends_with("(available: )"));
461        assert!(msg.contains("token"));
462    }
463}
464
465#[cfg(test)]
466mod tests {
467    use super::*;
468
469    #[test]
470    fn missing_env_selector_renders() {
471        let e = CliError::MissingEnvSelector {
472            var: "FAUCET_SOURCE".to_owned(),
473        };
474        let msg = e.to_string();
475        assert!(msg.contains("FAUCET_SOURCE"));
476        assert!(msg.contains("--from-env"));
477    }
478
479    #[test]
480    fn env_conflict_names_both_vars() {
481        let e = CliError::EnvConflict {
482            field: "auth".to_owned(),
483            scalar_var: "FAUCET_SOURCE_REST_AUTH".to_owned(),
484            json_var: "FAUCET_SOURCE_REST_AUTH_JSON".to_owned(),
485        };
486        let msg = e.to_string();
487        assert!(msg.contains("FAUCET_SOURCE_REST_AUTH"));
488        assert!(msg.contains("FAUCET_SOURCE_REST_AUTH_JSON"));
489    }
490
491    #[test]
492    fn invalid_env_json_names_var_and_parse_error() {
493        let e = CliError::InvalidEnvJson {
494            var: "FAUCET_SOURCE_REST_AUTH_JSON".to_owned(),
495            message: "expected value at line 1 column 1".to_owned(),
496        };
497        let msg = e.to_string();
498        assert!(msg.contains("FAUCET_SOURCE_REST_AUTH_JSON"));
499        assert!(msg.contains("expected value"));
500    }
501
502    #[test]
503    fn transform_index_gap_reports_missing_index() {
504        let e = CliError::TransformIndexGap { missing: 2 };
505        let msg = e.to_string();
506        assert!(msg.contains('2'));
507        assert!(msg.to_ascii_lowercase().contains("transform"));
508    }
509
510    #[test]
511    fn unknown_template_lists_known_names() {
512        let e = CliError::UnknownTemplate {
513            kind: "source",
514            name: "users_api".into(),
515            row_id: "load_users".into(),
516            known: vec!["customers_api".into(), "orders_api".into()],
517        };
518        let msg = e.to_string();
519        assert!(msg.contains("users_api"));
520        assert!(msg.contains("load_users"));
521        assert!(msg.contains("customers_api"));
522    }
523
524    #[test]
525    fn duplicate_template_names_kind() {
526        let e = CliError::DuplicateTemplate {
527            kind: "sink",
528            name: "default".into(),
529        };
530        let msg = e.to_string();
531        assert!(msg.contains("sink"));
532        assert!(msg.contains("default"));
533    }
534
535    #[test]
536    fn interpolation_cycle_renders_chain() {
537        let e = CliError::InterpolationCycle {
538            chain: vec!["vars.a".into(), "vars.b".into(), "vars.a".into()],
539        };
540        let msg = e.to_string();
541        assert!(msg.contains("vars.a"));
542        assert!(msg.contains("vars.b"));
543    }
544
545    #[test]
546    fn composition_cycle_renders_chain() {
547        let e = CliError::CompositionCycle {
548            chain: vec!["a.yaml".into(), "b.yaml".into(), "a.yaml".into()],
549        };
550        let msg = e.to_string();
551        assert!(msg.contains("a.yaml") && msg.contains("b.yaml"));
552        assert!(msg.contains(" -> "));
553    }
554
555    #[test]
556    fn unknown_profile_lists_known() {
557        let e = CliError::UnknownProfile {
558            name: "staging".into(),
559            known: vec!["dev".into(), "prod".into()],
560        };
561        let msg = e.to_string();
562        assert!(msg.contains("staging") && msg.contains("dev") && msg.contains("prod"));
563
564        let none = CliError::UnknownProfile {
565            name: "x".into(),
566            known: vec![],
567        };
568        assert!(none.to_string().contains("no `profiles:` block"));
569    }
570
571    #[test]
572    fn include_not_found_names_both_paths() {
573        let e = CliError::IncludeNotFound {
574            path: std::path::PathBuf::from("base.yaml"),
575            referenced_by: std::path::PathBuf::from("app.yaml"),
576        };
577        let msg = e.to_string();
578        assert!(msg.contains("base.yaml") && msg.contains("app.yaml"));
579    }
580
581    #[test]
582    fn composition_depth_exceeds_renders_max() {
583        assert!(
584            CliError::CompositionDepthExceeded { max: 32 }
585                .to_string()
586                .contains("32")
587        );
588    }
589
590    #[test]
591    fn bad_include_names_path_and_reason() {
592        let e = CliError::BadInclude {
593            path: std::path::PathBuf::from("f.yaml"),
594            reason: "!include payload must be a string path".into(),
595        };
596        assert!(e.to_string().contains("f.yaml") && e.to_string().contains("string path"));
597    }
598}
faucet_cli/error.rs

faucet_cli/
error.rs
