moq_auth/
error.rs

1/// Renders an error and its `source()` chain into a single message.
2///
3/// Dependency errors are stored as messages so their crates stay out of this crate's public
4/// API. Several of them keep the actionable half in `source()` and nothing but a category in
5/// `Display`, so a plain `to_string()` would drop the only detail worth reporting.
6pub(crate) fn message(err: impl std::error::Error) -> String {
7	use std::fmt::Write;
8
9	let mut out = err.to_string();
10	let mut source = err.source();
11	while let Some(err) = source {
12		let _ = write!(out, ": {err}");
13		source = err.source();
14	}
15	out
16}
17
18/// Errors related to key configuration and cryptographic operations.
19#[derive(Debug, thiserror::Error)]
20#[non_exhaustive]
21pub enum KeyError {
22	#[error("invalid algorithm for key type")]
23	InvalidAlgorithm,
24
25	#[error("invalid algorithm for {0} curve")]
26	InvalidAlgorithmForCurve(&'static str),
27
28	#[error("invalid coordinate length for {0}")]
29	InvalidCoordinateLength(&'static str),
30
31	#[error("invalid curve for {0} key")]
32	InvalidCurve(&'static str),
33
34	#[error("missing private key")]
35	MissingPrivateKey,
36
37	#[error("oct key secret must be at least {0} bytes")]
38	SecretTooShort(usize),
39
40	#[error("OCT key cannot be converted to public key")]
41	NoPublicKey,
42
43	#[error("key does not support verification")]
44	VerifyUnsupported,
45
46	#[error("key does not support signing")]
47	SignUnsupported,
48
49	#[error("cannot find signing key")]
50	NoSigningKey,
51
52	#[error("cannot find key with kid {0}")]
53	KeyNotFound(String),
54
55	#[error("missing kid in JWT header")]
56	MissingKid,
57
58	#[error("missing x() point in EC key")]
59	MissingEcX,
60
61	#[error("missing y() point in EC key")]
62	MissingEcY,
63}
64
65/// Top-level error type for moq-auth.
66#[derive(Debug, thiserror::Error)]
67#[non_exhaustive]
68pub enum Error {
69	#[error(transparent)]
70	Key(#[from] KeyError),
71
72	#[error("no publish or subscribe allowed; token is useless")]
73	UselessToken,
74
75	#[error("path `{0}` does not overlap the token root")]
76	RootMismatch(String),
77
78	#[error("token grants no access to path `{0}`")]
79	NoAccess(String),
80
81	#[error("no publish or subscribe allowed; key scope is useless")]
82	UselessScope,
83
84	#[error("token capabilities exceed the key scope")]
85	ScopeExceeded,
86
87	#[error("invalid algorithm: {0}")]
88	InvalidAlgorithm(String),
89
90	#[error("token has expired")]
91	TokenExpired,
92
93	#[error(transparent)]
94	Pattern(#[from] moq_pattern::InvalidPattern),
95
96	#[error("grant names nothing; the session is refused")]
97	UselessGrant,
98
99	#[error("grant asks to be revalidated but never expires")]
100	UnboundedRevalidate,
101
102	#[error("grant asks to be revalidated at no interval")]
103	ZeroRevalidate,
104
105	#[error("grant has already expired")]
106	GrantExpired,
107
108	#[error("the auth server refused the session")]
109	Refused,
110
111	#[error("auth server unavailable: {0}")]
112	Unavailable(String),
113
114	#[error("auth URL must be https://, unix://, or http:// to a loopback address: {0}")]
115	InsecureUrl(String),
116
117	#[error("invalid auth URL: {0}")]
118	InvalidUrl(String),
119
120	/// A JWK or claims document couldn't be parsed or serialized.
121	#[error("{0}")]
122	Json(String),
123
124	#[error(transparent)]
125	Io(#[from] std::io::Error),
126
127	/// A base64url field (a JWK coordinate, a JWT segment) isn't valid base64.
128	#[error("{0}")]
129	Base64(String),
130
131	#[error(transparent)]
132	Utf8(#[from] std::string::FromUtf8Error),
133
134	/// The JWT itself couldn't be signed, decoded, or verified.
135	#[error("{0}")]
136	Jwt(String),
137
138	/// A key couldn't be parsed, imported, or used by the crypto backend.
139	#[error("{0}")]
140	Crypto(String),
141
142	/// Fetching a remote JWKS failed.
143	#[error("{0}")]
144	Other(String),
145}
146
147// Dependency errors are flattened to their message so their crates stay out of this crate's
148// public API. Every one of them is opaque to a caller anyway: there is nothing to match on,
149// only something to report.
150macro_rules! from_message {
151	($($ty:ty => $variant:ident),* $(,)?) => {
152		$(
153			impl From<$ty> for Error {
154				fn from(err: $ty) -> Self {
155					Self::$variant(message(err))
156				}
157			}
158		)*
159	};
160}
161
162from_message! {
163	serde_json::Error => Json,
164	base64::DecodeError => Base64,
165	jsonwebtoken::errors::Error => Jwt,
166	p256::elliptic_curve::pkcs8::Error => Crypto,
167	p256::elliptic_curve::Error => Crypto,
168	rsa::Error => Crypto,
169	rsa::pkcs1::Error => Crypto,
170	aws_lc_rs::error::Unspecified => Crypto,
171	aws_lc_rs::error::KeyRejected => Crypto,
172}
173
174#[cfg(feature = "client")]
175from_message! {
176	reqwest::Error => Unavailable,
177}
178
179pub type Result<T> = std::result::Result<T, Error>;
180
181#[cfg(test)]
182mod tests {
183	use super::*;
184
185	/// A dependency that reports only a category in `Display` and keeps the real cause in
186	/// `source()` (reqwest is the one that matters here) must not lose it on conversion.
187	#[test]
188	fn message_flattens_the_source_chain() {
189		#[derive(Debug, thiserror::Error)]
190		#[error("inner")]
191		struct Inner;
192
193		#[derive(Debug, thiserror::Error)]
194		#[error("outer")]
195		struct Outer(#[source] Inner);
196
197		assert_eq!(message(Outer(Inner)), "outer: inner");
198	}
199}
moq_auth/error.rs

moq_auth/
error.rs
