webauthn_kit/
error.rs

1//! Error type for all `webauthn-kit` operations.
2
3/// Error type for `WebAuthn` operations.
4///
5/// The type is `#[non_exhaustive]`: matching on it requires a wildcard arm.
6///
7/// # Security note
8///
9/// Error strings may echo attacker-controlled fragments of the request being
10/// verified (e.g. a base64 payload or an origin string). They are intended for
11/// server-side logs and debugging. Do **not** forward raw error messages to
12/// untrusted clients; surface only a generic verification-failed response.
13#[non_exhaustive]
14#[derive(Debug, thiserror::Error)]
15pub enum WebauthnError {
16    /// A caller-supplied configuration value is invalid or inconsistent.
17    #[error("Configuration error: {0}")]
18    Config(String),
19    /// The presented challenge is unknown, malformed, or was already consumed
20    /// (single-use replay protection triggered).
21    #[error("Invalid challenge: {0}")]
22    InvalidChallenge(String),
23    /// The referenced credential does not exist for the given user/scope.
24    #[error("Credential not found: {0}")]
25    CredentialNotFound(String),
26    /// Generic verification failure (challenge mismatch, bad origin, wrong
27    /// `type` field, truncated authenticator data, RP ID hash mismatch, ...).
28    #[error("Verification failed: {0}")]
29    VerificationFailed(String),
30    /// The registration presented a credential ID that is already registered.
31    #[error("Duplicate credential: {0}")]
32    DuplicateCredential(String),
33    /// The referenced user does not exist.
34    #[error("User not found: {0}")]
35    UserNotFound(String),
36    /// The challenge was consumed after its freshness window elapsed.
37    #[error("Challenge expired")]
38    ChallengeExpired,
39    /// The COSE algorithm is not one of the supported/allowed algorithms.
40    #[error("Unsupported algorithm: {0}")]
41    UnsupportedAlgorithm(i32),
42    /// `ring` rejected the cryptographic signature.
43    #[error("Signature verification failed")]
44    SignatureVerificationFailed,
45    /// The attestation object or statement could not be parsed, or
46    /// attestation verification failed for a non-signature reason
47    /// (unsupported/unknown format, untrusted chain, expired certificate,
48    /// AAGUID extension mismatch, ...).
49    ///
50    /// Signature failures surface as [`WebauthnError::SignatureVerificationFailed`].
51    #[error("Attestation error: {0}")]
52    AttestationError(String),
53}
54
55// Tests exercise failure paths and invariants directly; unwrap/expect,
56// slicing, and panicking asserts are acceptable here — violations
57// surface as test failures, not production panics.
58#[allow(
59    clippy::unwrap_used,
60    clippy::expect_used,
61    clippy::indexing_slicing,
62    clippy::panic
63)]
64#[cfg(test)]
65mod tests {
66    use super::*;
67
68    #[test]
69    fn test_error_display_variants() {
70        let errors = vec![
71            WebauthnError::Config("test".to_string()),
72            WebauthnError::InvalidChallenge("test".to_string()),
73            WebauthnError::CredentialNotFound("test".to_string()),
74            WebauthnError::VerificationFailed("test".to_string()),
75            WebauthnError::DuplicateCredential("test".to_string()),
76            WebauthnError::UserNotFound("test".to_string()),
77            WebauthnError::ChallengeExpired,
78            WebauthnError::UnsupportedAlgorithm(-7),
79            WebauthnError::SignatureVerificationFailed,
80            WebauthnError::AttestationError("test".to_string()),
81        ];
82        for err in errors {
83            assert!(!format!("{err}").is_empty());
84            assert!(!format!("{err:?}").is_empty());
85        }
86    }
87}
webauthn_kit/error.rs

webauthn_kit/
error.rs
