rvoip-auth-core 0.3.8

OAuth2 and token-based authentication for RVoIP services
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

//! Error types for authentication operations

use std::fmt;

pub enum AuthError {
    InvalidToken(String),

    TokenExpired,

    InsufficientPermissions(String),

    ProviderError(String),

    ConfigError(String),

    NetworkError(String),

    CacheError(String),

    InternalError(String),

    InvalidChallenge(String),

    InvalidResponse(String),

    DigestError(String),
}

impl AuthError {
    fn diagnostic_class(&self) -> &'static str {
        match self {
            Self::InvalidToken(_) => "invalid-token",
            Self::TokenExpired => "token-expired",
            Self::InsufficientPermissions(_) => "insufficient-permissions",
            Self::ProviderError(_) => "provider",
            Self::ConfigError(_) => "configuration",
            Self::NetworkError(_) => "network",
            Self::CacheError(_) => "cache",
            Self::InternalError(_) => "internal",
            Self::InvalidChallenge(_) => "invalid-challenge",
            Self::InvalidResponse(_) => "invalid-response",
            Self::DigestError(_) => "digest-computation",
        }
    }
}

impl fmt::Display for AuthError {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(
            formatter,
            "authentication failed (class={})",
            self.diagnostic_class()
        )
    }
}

impl fmt::Debug for AuthError {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        formatter
            .debug_struct("AuthError")
            .field("class", &self.diagnostic_class())
            .finish()
    }
}

impl std::error::Error for AuthError {}

pub type Result<T> = std::result::Result<T, AuthError>;

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn arbitrary_lower_error_values_are_never_diagnostic_content() {
        const SECRET: &str = "auth-core-lower-error-secret-canary";
        let errors = [
            AuthError::InvalidToken(SECRET.into()),
            AuthError::InsufficientPermissions(SECRET.into()),
            AuthError::ProviderError(SECRET.into()),
            AuthError::ConfigError(SECRET.into()),
            AuthError::NetworkError(SECRET.into()),
            AuthError::CacheError(SECRET.into()),
            AuthError::InternalError(SECRET.into()),
            AuthError::InvalidChallenge(SECRET.into()),
            AuthError::InvalidResponse(SECRET.into()),
            AuthError::DigestError(SECRET.into()),
        ];

        for error in errors {
            let rendered = format!("{error} {error:?}");
            assert!(!rendered.contains(SECRET), "lower error leaked: {rendered}");
            match error {
                AuthError::InvalidToken(value)
                | AuthError::InsufficientPermissions(value)
                | AuthError::ProviderError(value)
                | AuthError::ConfigError(value)
                | AuthError::NetworkError(value)
                | AuthError::CacheError(value)
                | AuthError::InternalError(value)
                | AuthError::InvalidChallenge(value)
                | AuthError::InvalidResponse(value)
                | AuthError::DigestError(value) => assert_eq!(value, SECRET),
                AuthError::TokenExpired => unreachable!(),
            }
        }
    }
}