pubky-homeserver 0.12.0

A Pubky homeserver implementation.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

//! Domain errors for [`AuthService`](super::service::AuthService) operations.
//!
//! These errors capture business-logic failure modes without any HTTP coupling.
//! The HTTP status code mapping lives in [`error_mapping`](super::error_mapping).

use super::crypto::{grant_verifier, pop_verifier};
use super::persistence::grant::GrantStatus;
use crate::client_server::auth::SignupServiceError;

/// Domain errors from auth service operations.
#[derive(Debug, thiserror::Error)]
pub enum AuthServiceError {
    /// Grant JWS verification failed (signature, format, or expiry).
    #[error("Invalid grant: {0}")]
    InvalidGrant(#[from] grant_verifier::Error),

    /// PoP proof verification failed.
    #[error("Invalid PoP proof: {0}")]
    InvalidPopProof(#[from] pop_verifier::Error),

    /// User not found for the given public key.
    #[error("User not found")]
    UserNotFound,

    /// User already exists (signup conflict).
    #[error("User already exists")]
    UserAlreadyExists,

    /// Grant not found for the given grant ID.
    #[error("Grant not found")]
    GrantNotFound,

    /// Signup token is required but was not provided.
    #[error("Token required")]
    SignupTokenRequired,

    /// Signup token not found or invalid.
    #[error("Invalid token")]
    InvalidSignupToken,

    /// Signup token has already been used.
    #[error("Token already used")]
    SignupTokenAlreadyUsed,

    /// PoP nonce was already used (replay attack).
    #[error("PoP nonce already used")]
    NonceReplay,

    /// Grant has been revoked.
    #[error("Grant has been revoked")]
    GrantRevoked,

    /// Grant has expired.
    #[error("Grant has expired")]
    GrantExpired,

    /// Signup grant violates sessionless signup policy.
    #[error("Invalid signup grant: {0}")]
    InvalidSignupGrant(String),

    /// Session not found for the given token ID.
    #[error("Session not found")]
    SessionNotFound,

    /// Session token has expired.
    #[error("Session has expired")]
    SessionExpired,

    /// Grant does not belong to the authenticated user.
    #[error("Grant does not belong to authenticated user")]
    GrantOwnershipMismatch,

    /// Session lacks root capability.
    #[error("Root capability required")]
    RootCapabilityRequired,

    /// Database or infrastructure error.
    #[error("Internal error: {0}")]
    Internal(#[from] sqlx::Error),
}

impl From<GrantStatus> for AuthServiceError {
    fn from(status: GrantStatus) -> Self {
        match status {
            GrantStatus::Revoked => Self::GrantRevoked,
            GrantStatus::Expired => Self::GrantExpired,
        }
    }
}

impl From<SignupServiceError> for AuthServiceError {
    fn from(error: SignupServiceError) -> Self {
        match error {
            SignupServiceError::UserAlreadyExists => Self::UserAlreadyExists,
            SignupServiceError::SignupTokenRequired => Self::SignupTokenRequired,
            SignupServiceError::InvalidSignupToken => Self::InvalidSignupToken,
            SignupServiceError::SignupTokenAlreadyUsed => Self::SignupTokenAlreadyUsed,
            SignupServiceError::Internal(e) => Self::Internal(e),
        }
    }
}