1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
use super::{ADMIN_SCOPE, TOKEN_PREFIX};
/// Errors related to token operations.
#[derive(Debug)]
pub enum TokenError {
/// Token does not start with the expected prefix.
InvalidPrefix,
/// Token has expired.
///
/// `Some` when the record could be read, so the message can say when the
/// token was issued, how long it was good for, and how long ago it lapsed.
/// A user whose day-long session died could not otherwise tell a ceiling
/// from a clock skew from a revocation -- all three printed one sentence
/// (issue #355).
Expired(Option<ExpiryFacts>),
/// Token has been revoked.
Revoked,
/// No stored token has the requested subject ID.
NotFound(String),
/// Token is otherwise invalid (malformed, unparsable claims, ...).
Invalid(String),
/// The JWT is well formed but its signature does not verify with this
/// deployment's issuer secret: it was minted by another deployment, or
/// the secret changed (issue #644).
SignatureInvalid,
/// No usable issuer secret is configured, so nothing can be verified.
IssuerSecretUnset,
/// A client-bound token whose durable record is absent from this store,
/// typically after a rollback or a data-root switch (issue #644).
MissingRecord,
/// The signed client binding disagrees with the durable record.
BindingMismatch,
/// Token is valid but lacks the privilege scope the operation requires.
InsufficientScope,
/// Token has reached its per-token request budget (`max_requests`).
///
/// `Some` carries used and limit, which the store was holding when it
/// refused the request (issue #355).
LimitExceeded(Option<BudgetFacts>),
/// Token has reached its upstream-reported token budget (`max_tokens`).
TokenLimitExceeded(Option<BudgetFacts>),
/// Token has reached its configured one-minute request rate.
RateLimitExceeded,
/// Storage backend failure.
Storage(String),
}
/// When a token was issued, when it lapsed, and how long ago that was.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct ExpiryFacts {
/// When the token was issued.
pub issued_at: i64,
/// When it expired.
pub expires_at: i64,
/// How long ago it expired, at the moment of the rejection.
pub ago_seconds: i64,
}
/// How much of a bound has been spent.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct BudgetFacts {
/// The amount already consumed.
pub used: u64,
/// The bound it was measured against.
pub limit: u64,
}
/// Render a unix timestamp for a person reading an error message.
fn render_time(seconds: i64) -> String {
chrono::DateTime::from_timestamp(seconds, 0)
.map_or_else(|| seconds.to_string(), |time| time.to_rfc3339())
}
/// Render a span of seconds as the largest unit that stays readable.
///
/// "expired 3d ago" answers the question a user has; a unix timestamp does not.
fn render_duration(seconds: i64) -> String {
let seconds = seconds.abs();
match seconds {
0..=90 => format!("{seconds}s"),
91..=5399 => format!("{}m", (seconds + 30) / 60),
5400..=172_799 => format!("{}h", (seconds + 1800) / 3600),
_ => format!("{}d", (seconds + 43200) / 86400),
}
}
impl std::fmt::Display for TokenError {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
match self {
Self::InvalidPrefix => {
write!(
f,
"Token must start with '{TOKEN_PREFIX}' or '{}' prefix",
crate::token::CODEX_TOKEN_PREFIX
)
}
Self::Expired(None) => write!(f, "Token has expired"),
Self::Expired(Some(facts)) => write!(
f,
"Token expired at {} ({} ago)",
render_time(facts.expires_at),
render_duration(facts.ago_seconds)
),
Self::Revoked => write!(f, "Token has been revoked"),
Self::NotFound(id) => write!(f, "Token not found: {id}"),
Self::Invalid(msg) => write!(f, "Invalid token: {msg}"),
Self::SignatureInvalid => write!(
f,
"Invalid token: signature does not verify with this deployment's issuer secret"
),
Self::IssuerSecretUnset => {
write!(f, "Invalid token: {}", crate::token_secret::refusal())
}
Self::MissingRecord => write!(
f,
"Invalid token: bound client token has no durable token record"
),
Self::BindingMismatch => write!(
f,
"Invalid token: signed client binding does not match the durable token record"
),
Self::InsufficientScope => {
write!(f, "Token does not carry the '{ADMIN_SCOPE}' scope")
}
Self::LimitExceeded(None) => write!(f, "Token has reached its request limit"),
Self::LimitExceeded(Some(facts)) => write!(
f,
"Token has reached its request limit: {} of {} requests used",
facts.used, facts.limit
),
Self::TokenLimitExceeded(None) => write!(f, "Token has reached its token limit"),
Self::TokenLimitExceeded(Some(facts)) => write!(
f,
"Token has reached its token limit: {} of {} tokens used",
facts.used, facts.limit
),
Self::RateLimitExceeded => write!(f, "Token has reached its per-minute rate limit"),
Self::Storage(msg) => write!(f, "Token storage error: {msg}"),
}
}
}
impl TokenError {
/// Stable message safe to return across the unauthenticated client boundary.
///
/// Decoder and storage details remain available through [`std::fmt::Display`]
/// for server-side logs, but must not disclose parser internals to callers.
#[must_use]
pub fn client_message(&self) -> std::borrow::Cow<'static, str> {
use std::borrow::Cow;
match self {
// Every verification failure reads the same to the caller; the
// distinction is served on the protected diagnostics endpoint.
Self::InvalidPrefix
| Self::Invalid(_)
| Self::SignatureInvalid
| Self::IssuerSecretUnset
| Self::MissingRecord
| Self::BindingMismatch => Cow::Borrowed("invalid token"),
// Names the router and the flag, because the client renders its
// own advice otherwise: a Claude Code session whose per-run token
// expired mid-work was told `Please run /login`, which points at
// the Anthropic subscription -- a different credential entirely,
// and re-authenticating it changes nothing (issue #341).
Self::Expired(None) => Cow::Borrowed(
"Token has expired: this is the router's own token, not the model provider's. \
A per-run token from `router with` lives for --run-ttl-hours; re-running the \
command mints a new one.",
),
Self::Expired(Some(facts)) => Cow::Owned(format!(
"Token has expired: this is the router's own token, not the model provider's. \
Issued {issued}, good for {lifetime}, expired {expired} ({ago} ago). \
A per-run token from `router with` lives for --run-ttl-hours; re-running the \
command mints a new one.",
issued = render_time(facts.issued_at),
lifetime = render_duration(facts.expires_at - facts.issued_at),
expired = render_time(facts.expires_at),
ago = render_duration(facts.ago_seconds),
)),
Self::Revoked => Cow::Borrowed("Token has been revoked"),
Self::NotFound(_) => Cow::Borrowed("token not found"),
Self::InsufficientScope => Cow::Borrowed("insufficient token scope"),
Self::LimitExceeded(None) => Cow::Borrowed("Token has reached its request limit"),
Self::LimitExceeded(Some(facts)) => Cow::Owned(format!(
"Token has reached its request limit: {} of {} requests used. Issue a token \
with a larger --max-requests, or use a new one.",
facts.used, facts.limit
)),
Self::TokenLimitExceeded(None) => Cow::Borrowed("Token has reached its token limit"),
Self::TokenLimitExceeded(Some(facts)) => Cow::Owned(format!(
"Token has reached its token limit: {} of {} tokens used. Issue a token with a \
larger --max-tokens, or use a new one.",
facts.used, facts.limit
)),
Self::RateLimitExceeded => Cow::Borrowed("Token has reached its per-minute rate limit"),
Self::Storage(_) => Cow::Borrowed("token validation failed"),
}
}
}
impl std::error::Error for TokenError {}