1use crate::http::AppError;
2use thiserror::Error;
3
4#[derive(Debug, Error)]
5pub enum SecurityError {
6 #[error("JWT configuration error: {0}")]
7 Config(String),
8
9 #[error("invalid or expired token")]
10 InvalidToken,
11
12 #[error("missing Authorization header")]
13 MissingAuthorization,
14
15 #[error("invalid Authorization scheme (expected Bearer)")]
16 InvalidScheme,
17
18 #[error(transparent)]
19 Jwt(#[from] jsonwebtoken::errors::Error),
20}
21
22impl SecurityError {
23 pub fn into_app_error(self) -> AppError {
24 match self {
25 Self::InvalidToken | Self::MissingAuthorization | Self::InvalidScheme => {
26 AppError::unauthorized(self.to_string())
27 }
28 Self::Config(msg) => AppError::internal(msg),
29 Self::Jwt(e) => AppError::unauthorized(format!("token rejected: {e}")),
30 }
31 }
32}