mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
d99ad131f1
Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <wpfleger@block.xyz> Signed-off-by: Will Pfleger <wpfleger@squareup.com> Signed-off-by: Will Pfleger <wpfleger96@gmail.com> Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub1fgdl5qqnh3k3f2xkqrvt7cujalhm623x4s7fdjdj5yrtp5fzjl9qrjpucw <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub16v54tttfqacx9ycvc3k0ut0npj564ahcuajzy6qjvh57ntmsf4uq4806j2 <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@sprout-oss.stage.blox.sqprod.co> Co-authored-by: Will Pfleger <wpfleger96@gmail.com>
54 lines
2.1 KiB
Rust
54 lines
2.1 KiB
Rust
//! Error types for buzz-auth.
|
|
|
|
/// All errors that can occur during authentication and authorization.
|
|
///
|
|
/// Variants are designed to be safe to return to callers without leaking
|
|
/// internal implementation details. Do **not** include raw token values,
|
|
/// database contents, or stack traces in error messages.
|
|
#[derive(Debug, thiserror::Error)]
|
|
pub enum AuthError {
|
|
/// The NIP-42 event signature is invalid or the event is structurally malformed.
|
|
#[error("invalid signature or malformed auth event")]
|
|
InvalidSignature,
|
|
|
|
/// The `challenge` tag in the AUTH event does not match the relay's issued challenge.
|
|
#[error("challenge mismatch")]
|
|
ChallengeMismatch,
|
|
|
|
/// The `relay` tag in the AUTH event does not match this relay's URL.
|
|
#[error("relay url mismatch")]
|
|
RelayUrlMismatch,
|
|
|
|
/// The AUTH event's `created_at` timestamp is more than ±60 seconds from now.
|
|
#[error("auth event timestamp outside ±60s window")]
|
|
EventExpired,
|
|
|
|
/// NIP-98 HTTP Auth event (kind:27235) failed verification.
|
|
///
|
|
/// The inner string describes the specific failure (signature, timestamp, URL, etc.)
|
|
/// and is safe to include in server logs. Do **not** forward raw event content to clients.
|
|
#[error("NIP-98 HTTP Auth verification failed: {0}")]
|
|
Nip98Invalid(String),
|
|
|
|
/// The pubkey in the auth event does not match the expected identity.
|
|
#[error("pubkey mismatch: event pubkey does not match authenticated identity")]
|
|
PubkeyMismatch,
|
|
|
|
/// The authenticated context does not have the required scope for this operation.
|
|
#[error("insufficient scope: required {required}, have {have:?}")]
|
|
InsufficientScope {
|
|
/// The scope that was required.
|
|
required: String,
|
|
/// The scopes the caller actually holds.
|
|
have: Vec<String>,
|
|
},
|
|
|
|
/// The authenticated user is not a member of the requested channel.
|
|
#[error("channel access denied")]
|
|
ChannelAccessDenied,
|
|
|
|
/// An unexpected internal error occurred (e.g. a `spawn_blocking` panic).
|
|
#[error("internal auth error: {0}")]
|
|
Internal(String),
|
|
}
|