ironcore_alloy/tenant_security_client/
errors.rs

1use std::fmt::{Display, Formatter, Result as DisplayResult};
2use thiserror::Error;
3
4/// Errors originating from the Tenant Security Proxy.
5/// These errors are broken into 4 types: service errors, KMS errors,
6/// security event errors, and tenant secret errors.
7#[derive(Error, Debug, PartialEq, Eq, uniffi::Enum, Clone)]
8#[non_exhaustive]
9pub enum TenantSecurityProxyError {
10    Service { error: ServiceError },
11    Kms { error: KmsError },
12    SecurityEvent { error: SecurityEventError },
13    TenantSecret { error: TenantSecretError },
14}
15
16/// Errors communicating with the TSP
17#[derive(Debug, PartialEq, Eq, uniffi::Enum, Clone)]
18#[non_exhaustive]
19pub enum ServiceError {
20    UnknownError,
21    UnauthorizedRequest,
22    InvalidRequestBody,
23}
24
25/// Errors originating from or relating to the tenant's KMS
26#[derive(Debug, PartialEq, Eq, uniffi::Enum, Clone)]
27#[non_exhaustive]
28pub enum KmsError {
29    NoPrimaryKmsConfiguration,
30    UnknownTenantOrNoActiveKmsConfigurations,
31    KmsConfigurationDisabled,
32    InvalidProvidedEdek,
33    KmsWrapFailed,
34    KmsUnwrapFailed,
35    KmsAuthorizationFailed,
36    KmsConfigurationInvalid,
37    KmsUnreachable,
38    KmsThrottled,
39    KmsAccountIssue,
40}
41
42/// Errors related to security events
43#[derive(Debug, PartialEq, Eq, uniffi::Enum, Clone)]
44#[non_exhaustive]
45pub enum SecurityEventError {
46    SecurityEventRejected,
47}
48
49/// Errors related to tenant secrets
50#[derive(Debug, PartialEq, Eq, uniffi::Enum, Clone)]
51#[non_exhaustive]
52pub enum TenantSecretError {
53    SecretCreationFailed,
54}
55
56impl TenantSecurityProxyError {
57    pub(crate) fn code_to_error(code: u16) -> TenantSecurityProxyError {
58        use KmsError::*;
59        use SecurityEventError::*;
60        use ServiceError::*;
61        use TenantSecretError::*;
62
63        match code {
64            100 => Self::Service {
65                error: UnknownError,
66            },
67            101 => Self::Service {
68                error: UnauthorizedRequest,
69            },
70            102 => Self::Service {
71                error: InvalidRequestBody,
72            },
73            200 => Self::Kms {
74                error: NoPrimaryKmsConfiguration,
75            },
76            201 => Self::Kms {
77                error: UnknownTenantOrNoActiveKmsConfigurations,
78            },
79            202 => Self::Kms {
80                error: KmsConfigurationDisabled,
81            },
82            203 => Self::Kms {
83                error: InvalidProvidedEdek,
84            },
85            204 => Self::Kms {
86                error: KmsWrapFailed,
87            },
88            205 => Self::Kms {
89                error: KmsUnwrapFailed,
90            },
91            206 => Self::Kms {
92                error: KmsAuthorizationFailed,
93            },
94            207 => Self::Kms {
95                error: KmsConfigurationInvalid,
96            },
97            208 => Self::Kms {
98                error: KmsUnreachable,
99            },
100            209 => Self::Kms {
101                error: KmsThrottled,
102            },
103            301 => Self::SecurityEvent {
104                error: SecurityEventRejected,
105            },
106            401 => Self::TenantSecret {
107                error: SecretCreationFailed,
108            },
109            _ => Self::Service {
110                error: UnknownError,
111            },
112        }
113    }
114
115    pub fn get_code(&self) -> u16 {
116        match self {
117            Self::Service { error, .. } => match error {
118                ServiceError::UnknownError => 100,
119                ServiceError::UnauthorizedRequest => 101,
120                ServiceError::InvalidRequestBody => 102,
121            },
122            Self::Kms { error, .. } => match error {
123                KmsError::NoPrimaryKmsConfiguration => 200,
124                KmsError::UnknownTenantOrNoActiveKmsConfigurations => 201,
125                KmsError::KmsConfigurationDisabled => 202,
126                KmsError::InvalidProvidedEdek => 203,
127                KmsError::KmsWrapFailed => 204,
128                KmsError::KmsUnwrapFailed => 205,
129                KmsError::KmsAuthorizationFailed => 206,
130                KmsError::KmsConfigurationInvalid => 207,
131                KmsError::KmsUnreachable => 208,
132                KmsError::KmsThrottled => 209,
133                KmsError::KmsAccountIssue => 210,
134            },
135            Self::SecurityEvent { error, .. } => match error {
136                SecurityEventError::SecurityEventRejected => 301,
137            },
138            Self::TenantSecret { error, .. } => match error {
139                TenantSecretError::SecretCreationFailed => 401,
140            },
141        }
142    }
143}
144
145impl Display for TenantSecurityProxyError {
146    fn fmt(&self, f: &mut Formatter) -> DisplayResult {
147        match self {
148            Self::Service { error } => write!(f, "{error}"),
149            Self::Kms { error } => write!(f, "{error}"),
150            Self::SecurityEvent { error } => write!(f, "{error}"),
151            Self::TenantSecret { error } => write!(f, "{error}"),
152        }
153    }
154}
155
156impl Display for ServiceError {
157    fn fmt(&self, f: &mut Formatter) -> DisplayResult {
158        match self {
159            Self::UnknownError => write!(f, "Unknown request error occurred"),
160            Self::UnauthorizedRequest => {
161                write!(f, "Request authorization header API key was incorrect")
162            }
163            Self::InvalidRequestBody => write!(f, "Request body was invalid"),
164        }
165    }
166}
167
168impl Display for KmsError {
169    fn fmt(&self, f: &mut Formatter) -> DisplayResult {
170        match self {
171            Self::NoPrimaryKmsConfiguration => write!(f, "Tenant has no primary KMS configuration"),
172            Self::UnknownTenantOrNoActiveKmsConfigurations => write!(
173                f,
174                "Tenant either doesn't exist or has no active KMS configurations"
175            ),
176            Self::KmsConfigurationDisabled => write!(
177                f,
178                "Tenant configuration specified in EDEK is no longer active"
179            ),
180            Self::InvalidProvidedEdek => write!(f, "Provided EDEK was not valid"),
181            Self::KmsWrapFailed => {
182                write!(f, "Request to KMS API to wrap key returned invalid results")
183            }
184            Self::KmsUnwrapFailed => write!(
185                f,
186                "Request to KMS API to unwrap key returned invalid results"
187            ),
188            Self::KmsAuthorizationFailed => write!(
189                f,
190                "Request to KMS failed because the tenant credentials were invalid or have been revoked"
191            ),
192            Self::KmsConfigurationInvalid => write!(
193                f,
194                "Request to KMS failed because the key configuration was invalid or the necessary permissions for the operation were missing/revoked"
195            ),
196            Self::KmsUnreachable => write!(f, "Request to KMS failed because KMS was unreachable"),
197            Self::KmsThrottled => write!(
198                f,
199                "Request to KMS failed because KMS throttled the Tenant Security Proxy"
200            ),
201            Self::KmsAccountIssue => write!(
202                f,
203                "Request to KMS failed because of an issue with the KMS account."
204            ),
205        }
206    }
207}
208impl Display for SecurityEventError {
209    fn fmt(&self, f: &mut Formatter) -> DisplayResult {
210        match self {
211            Self::SecurityEventRejected => write!(
212                f,
213                "Tenant Security Proxy could not accept the security event"
214            ),
215        }
216    }
217}
218impl Display for TenantSecretError {
219    fn fmt(&self, f: &mut Formatter) -> DisplayResult {
220        match self {
221            Self::SecretCreationFailed => write!(
222                f,
223                "Tenant Security Proxy failed to create a secret for the provided tenant"
224            ),
225        }
226    }
227}
ironcore_alloy/tenant_security_client/errors.rs

ironcore_alloy/tenant_security_client/
errors.rs
