systemprompt_security/authz/
error.rs

1//! Typed error surface for the authz crate.
2//!
3//! Copyright (c) systemprompt.io — Business Source License 1.1.
4//! See <https://systemprompt.io> for licensing details.
5
6use systemprompt_models::domain_error;
7use thiserror::Error;
8
9domain_error! {
10    pub enum AuthzError {
11        common: [repository, validation],
12
13        #[error("invalid rule_type: {0}")]
14        InvalidRuleType(String),
15
16        #[error("invalid access value: {0}")]
17        InvalidAccess(String),
18
19        #[error("authz hook transport: {0}")]
20        Hook(#[from] reqwest::Error),
21
22        #[error("authz bootstrap: {0}")]
23        Bootstrap(#[from] AuthzBootstrapError),
24    }
25}
26
27impl From<sqlx::Error> for AuthzError {
28    fn from(err: sqlx::Error) -> Self {
29        Self::Repository(systemprompt_database::RepositoryError::from(err))
30    }
31}
32
33pub type AuthzResult<T> = Result<T, AuthzError>;
34
35#[derive(Debug, Clone, Error)]
36pub enum AuthzBootstrapError {
37    #[error(
38        "governance.authz.hook.mode = webhook but `url` is missing or blank — refusing to start"
39    )]
40    MissingWebhookUrl,
41
42    #[error("governance.authz.hook.url is invalid or unsafe: {0} — refusing to start")]
43    InvalidWebhookUrl(String),
44
45    #[error(
46        "governance.authz.hook.mode = unrestricted requires `acknowledgement` field equal to the \
47         literal: {expected:?}"
48    )]
49    MissingUnrestrictedAcknowledgement { expected: &'static str },
50
51    #[error(
52        "governance.authz.hook.mode = extension but no extension hook was supplied via \
53         AppContextBuilder::with_authz_hook(...) — refusing to start"
54    )]
55    ExtensionModeButNoHook,
56
57    #[error(
58        "an extension authz hook was supplied via AppContextBuilder::with_authz_hook(...) but \
59         governance.authz.hook.mode is `{mode}` (must be `extension`) — refusing to start"
60    )]
61    ExtensionHookButWrongMode { mode: &'static str },
62
63    #[error(
64        "an extension authz hook was supplied via AppContextBuilder::with_authz_hook(...) but the \
65         profile has no `governance.authz` block — set `governance.authz.hook.mode = extension` \
66         or drop the `with_authz_hook` call"
67    )]
68    NoGovernanceButExtensionHook,
69}
systemprompt_security/authz/error.rs

systemprompt_security/authz/
error.rs
