huskarl_core/crypto/verifier/
error.rs

1use snafu::Snafu;
2
3use crate::error::Error;
4
5/// Errors that could occur during verification.
6///
7/// The variants are load-bearing control flow between verifier layers:
8/// [`NoMatchingKey`](Self::NoMatchingKey) drives the refresh-and-retry loop
9/// in [`RetryingVerifier`](super::RetryingVerifier) and candidate dispatch in
10/// [`MultiKeyVerifier`](super::MultiKeyVerifier), so this enum survives the
11/// dyn-first error collapse — only its `Other` source is the concrete
12/// [`Error`].
13#[non_exhaustive]
14#[derive(Debug, Snafu)]
15pub enum VerifyError {
16    /// No key matched the requested algorithm/kid pair.
17    #[snafu(display("no matching key"))]
18    NoMatchingKey,
19    /// Multiple keys matched but the token has no `kid` to disambiguate.
20    #[snafu(display("ambiguous key: multiple keys match but token has no kid"))]
21    AmbiguousKeyMatch,
22    /// Signature mismatch, verification failed.
23    #[snafu(display("signature mismatch"))]
24    SignatureMismatch,
25    /// Other kinds of errors that could occur during verification.
26    #[snafu(transparent)]
27    Other {
28        /// The underlying error.
29        source: Error,
30    },
31}
32
33impl VerifyError {
34    /// If true, a failed verification may succeed if retried.
35    #[must_use]
36    pub fn is_retryable(&self) -> bool {
37        match self {
38            VerifyError::NoMatchingKey
39            | VerifyError::AmbiguousKeyMatch
40            | VerifyError::SignatureMismatch => false,
41            VerifyError::Other { source } => source.is_retryable(),
42        }
43    }
44}
45
46/// Errors that could occur while trying to create a verifier.
47#[derive(Debug, Snafu)]
48pub enum CreateVerifierError {
49    /// The key is unsupported.
50    ///
51    /// [`MultiKeyVerifier::from_jwks`](super::MultiKeyVerifier::from_jwks)
52    /// silently skips keys that fail with this variant.
53    #[snafu(display("Unsupported key"))]
54    UnsupportedKey,
55    /// No JWKS URI was provided to the verifier factory.
56    #[snafu(display("A JWKS URI is required to build a JWS verifier"))]
57    MissingJwksUri,
58    /// Other kinds of errors that may occur while creating a verifier.
59    #[snafu(transparent)]
60    Other {
61        /// The underlying error.
62        source: Error,
63    },
64}
huskarl_core/crypto/verifier/error.rs

huskarl_core/crypto/verifier/
error.rs
