webgates_secrets/hashing/

errors.rs

//! Error types for hashing and verification.
//!
//! This module defines the structured error types used by hashing
//! implementations and secret verification flows.
//!
//! [`HashingError`] describes caller-visible hashing failures, and
//! [`HashingOperation`] identifies which operation failed.
//!
//! # Examples
//!
//! Construct a hashing error with algorithm context:
//! ```rust
//! use webgates_core::errors_core::UserFriendlyError;
//! use webgates_secrets::hashing::errors::{HashingError, HashingOperation};
//!
//! let err = HashingError::with_algorithm(
//!     HashingOperation::Hash,
//!     "argon2 hashing failed",
//!     "argon2id",
//! );
//!
//! assert!(err.user_message().contains("security processing system"));
//! assert!(err.developer_message().contains("Hash operation hash failed"));
//! assert!(err.support_code().starts_with("HASH-HASH"));
//! ```
//!
//! Construct a verification failure where retry is possible:
//! ```rust
//! use webgates_core::errors_core::UserFriendlyError;
//! use webgates_secrets::hashing::errors::{HashingError, HashingOperation};
//!
//! let err = HashingError::with_context(
//!     HashingOperation::Verify,
//!     "password verification failed",
//!     Some("argon2id".into()),
//!     Some("$argon2id$v=19$...".into()),
//! );
//! assert!(err.is_retryable());
//! ```

use std::collections::hash_map::DefaultHasher;
use std::fmt;
use std::hash::{Hash, Hasher};
use thiserror::Error;
use webgates_core::errors_core::{ErrorSeverity, UserFriendlyError};

/// Hashing operation identifiers used for structured error reporting.
#[derive(Debug, Clone)]
pub enum HashingOperation {
    /// Compute a new hash for a provided plaintext value.
    Hash,
    /// Verify a plaintext value against an existing hash.
    Verify,
}

impl fmt::Display for HashingOperation {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            HashingOperation::Hash => write!(f, "hash"),
            HashingOperation::Verify => write!(f, "verify"),
        }
    }
}

/// Error returned by hashing services and verification flows.
///
/// Use this type when hashing or verification cannot be completed safely.
#[derive(Debug, Error)]
#[non_exhaustive]
pub enum HashingError {
    /// A hashing-related operation failed.
    #[error("Hashing error: {operation} - {message}")]
    Operation {
        /// The hashing operation that failed.
        operation: HashingOperation,
        /// Description of the error (non-sensitive).
        message: String,
        /// The hashing algorithm used (e.g., `argon2id`, `bcrypt`) if known.
        algorithm: Option<String>,
        /// Expected hash format (sanitized) if relevant.
        expected_format: Option<String>,
    },
}

impl HashingError {
    /// Creates a hashing error without algorithm or format context.
    ///
    /// # Examples
    /// ```rust
    /// use webgates_secrets::hashing::errors::{HashingError, HashingOperation};
    /// let _err = HashingError::new(HashingOperation::Hash, "failed to hash value");
    /// ```
    pub fn new(operation: HashingOperation, message: impl Into<String>) -> Self {
        HashingError::Operation {
            operation,
            message: message.into(),
            algorithm: None,
            expected_format: None,
        }
    }

    /// Creates a hashing error with algorithm context.
    ///
    /// # Examples
    /// ```rust
    /// use webgates_secrets::hashing::errors::{HashingError, HashingOperation};
    /// let _err = HashingError::with_algorithm(HashingOperation::Verify, "verification failed", "argon2id");
    /// ```
    pub fn with_algorithm(
        operation: HashingOperation,
        message: impl Into<String>,
        algorithm: impl Into<String>,
    ) -> Self {
        HashingError::Operation {
            operation,
            message: message.into(),
            algorithm: Some(algorithm.into()),
            expected_format: None,
        }
    }

    /// Creates a hashing error with full context.
    ///
    /// # Examples
    /// ```rust
    /// use webgates_secrets::hashing::errors::{HashingError, HashingOperation};
    /// let _err = HashingError::with_context(
    ///     HashingOperation::Verify,
    ///     "verification failed",
    ///     Some("argon2id".into()),
    ///     Some("$argon2id$v=19$...".into()),
    /// );
    /// ```
    pub fn with_context(
        operation: HashingOperation,
        message: impl Into<String>,
        algorithm: Option<String>,
        expected_format: Option<String>,
    ) -> Self {
        HashingError::Operation {
            operation,
            message: message.into(),
            algorithm,
            expected_format,
        }
    }

    /// Deterministic, category-specific support code for this error.
    fn support_code_inner(&self) -> String {
        let mut hasher = DefaultHasher::new();
        match self {
            HashingError::Operation {
                operation,
                algorithm,
                ..
            } => {
                format!("HASH-{}-{:X}", operation.to_string().to_uppercase(), {
                    format!("{:?}{:?}", operation, algorithm).hash(&mut hasher);
                    hasher.finish() % 10000
                })
            }
        }
    }
}

impl UserFriendlyError for HashingError {
    fn user_message(&self) -> String {
        match self {
            HashingError::Operation { operation, .. } => match operation {
                HashingOperation::Hash => {
                    "There's an issue with the security processing system. Please try again in a moment."
                        .to_string()
                }
                HashingOperation::Verify => {
                    "We couldn't verify your credentials due to a technical issue. Please try signing in again."
                        .to_string()
                }
            },
        }
    }

    fn developer_message(&self) -> String {
        match self {
            HashingError::Operation {
                operation,
                message,
                algorithm,
                expected_format,
            } => {
                let algorithm_context = algorithm
                    .as_ref()
                    .map(|a| format!(" [Algorithm: {}]", a))
                    .unwrap_or_default();
                let format_context = expected_format
                    .as_ref()
                    .map(|ef| format!(" [Expected: {}]", ef))
                    .unwrap_or_default();
                format!(
                    "Hash operation {} failed: {}{}{}",
                    operation, message, algorithm_context, format_context
                )
            }
        }
    }

    fn support_code(&self) -> String {
        self.support_code_inner()
    }

    fn severity(&self) -> ErrorSeverity {
        match self {
            HashingError::Operation { operation, .. } => match operation {
                HashingOperation::Hash => ErrorSeverity::Critical,
                HashingOperation::Verify => ErrorSeverity::Critical,
            },
        }
    }

    fn suggested_actions(&self) -> Vec<String> {
        match self {
            HashingError::Operation { operation, .. } => match operation {
                HashingOperation::Hash => vec![
                    "This is a critical security system error".to_string(),
                    "Contact our support team immediately".to_string(),
                    "Do not retry operations that involve password or secret changes".to_string(),
                    "Use secure communication when reporting this issue".to_string(),
                ],
                HashingOperation::Verify => vec![
                    "Double-check your password for typos".to_string(),
                    "Ensure Caps Lock is not accidentally enabled".to_string(),
                    "If you're certain your password is correct, contact support".to_string(),
                    "Try using password recovery if verification continues to fail".to_string(),
                ],
            },
        }
    }

    fn is_retryable(&self) -> bool {
        match self {
            HashingError::Operation { operation, .. } => match operation {
                HashingOperation::Hash => false,  // critical system condition
                HashingOperation::Verify => true, // user can retry with correct credentials
            },
        }
    }
}