arsenal-core · error

pub type ArsenalResult<T> = Result<T, ArsenalError>;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum ErrorCode {
    // Authentication errors (1xxx)
    /// Invalid or missing credentials
    AuthenticationFailed = 1001,
    /// Token expired
    TokenExpired = 1002,
    /// Token signature verification failed
    TokenSignatureInvalid = 1003,
    /// Proof-of-possession verification failed
    PopVerificationFailed = 1004,
    /// Identity not found or invalid
    IdentityInvalid = 1005,
    /// Session has expired or been revoked
    SessionExpired = 1006,

    // Authorization errors (2xxx)
    /// Insufficient permissions for requested operation
    InsufficientPermissions = 2001,
    /// Requested scope exceeds granted scope
    ScopeExceeded = 2002,
    /// Policy evaluation denied the request
    PolicyDenied = 2003,
    /// Delegation chain is invalid or broken
    DelegationInvalid = 2004,
    /// Rate limit exceeded
    RateLimitExceeded = 2005,
    /// Usage budget exhausted
    BudgetExhausted = 2006,

    // Constraint violations (3xxx)
    /// Request violates time-based constraints
    TimeConstraintViolation = 3001,
    /// Request violates environment binding
    EnvironmentBindingViolation = 3002,
    /// Request violates IP/network constraints
    NetworkConstraintViolation = 3003,
    /// Request violates device binding
    DeviceBindingViolation = 3004,
    /// Request violates origin binding
    OriginBindingViolation = 3005,

    // Secret management errors (4xxx)
    /// Secret not found
    SecretNotFound = 4001,
    /// Secret version not found
    SecretVersionNotFound = 4002,
    /// Secret has been revoked
    SecretRevoked = 4003,
    /// Secret rotation in progress
    SecretRotationInProgress = 4004,
    /// Secret unwrap limit exceeded
    SecretUnwrapLimitExceeded = 4005,
    /// Encryption/decryption failed
    CryptoOperationFailed = 4006,

    // Validation errors (5xxx)
    /// Input validation failed
    ValidationFailed = 5001,
    /// Malformed request
    MalformedRequest = 5002,
    /// Invalid token format
    InvalidTokenFormat = 5003,
    /// Invalid scope format
    InvalidScopeFormat = 5004,
    /// Invalid constraint specification
    InvalidConstraint = 5005,

    // Internal errors (6xxx)
    /// Internal service error
    InternalError = 6001,
    /// Storage backend error
    StorageError = 6002,
    /// Configuration error
    ConfigurationError = 6003,
    /// Cryptographic subsystem error
    CryptoSubsystemError = 6004,
    /// Audit subsystem error
    AuditError = 6005,
    /// Serialization failed
    SerializationFailed = 6006,

    // Revocation errors (7xxx)
    /// Token has been explicitly revoked
    TokenRevoked = 7001,
    /// Agent has been deactivated
    AgentDeactivated = 7002,
    /// Tenant has been suspended
    TenantSuspended = 7003,
    /// Revocation status could not be determined (fail-closed policy path)
    RevocationStatusUnknown = 7004,

    // Proxy errors (8xxx)
    /// Request violates destination binding for the credential
    ProxyDestinationViolation = 8001,
    /// Proxy request to target API failed
    ProxyRequestFailed = 8002,
    /// Proxy request timed out
    ProxyTimeout = 8003,
    /// Request blocked by SSRF protection
    SsrfBlocked = 8004,
    /// Referenced template variable not found in resolution table
    TemplateVariableNotFound = 8005,
    /// Agent does not have permission to access the template variable
    TemplateVariableAccessDenied = 8006,
    /// Template variable name is malformed
    InvalidTemplateVariable = 8007,
    /// OAuth token requires re-authentication
    OAuthReauthRequired = 8008,

    // Consent errors (9xxx)
    /// Human consent is required before accessing the credential
    ConsentRequired = 9001,
    /// Consent was explicitly denied
    ConsentDenied = 9002,
    /// Consent record has expired
    ConsentExpired = 9003,
    /// Consent was previously granted but has been revoked
    ConsentRevoked = 9004,

    // Fingerprint errors (10xxx)
    /// Agent fingerprint does not match expected hash chain state
    FingerprintMismatch = 10001,
    /// Agent fingerprint state not found (agent not initialized)
    FingerprintStateNotFound = 10002,

    // Delegation errors (11xxx)
    /// Delegated credential token attempts scope amplification
    DctScopeAmplification = 11001,
    /// Delegation depth exceeds maximum allowed
    DctDepthExceeded = 11002,
}

#[must_use]
pub const fn as_u32(self) -> u32;

#[must_use]
pub const fn is_client_error(self) -> bool;

#[must_use]
pub const fn is_server_error(self) -> bool;

#[must_use]
pub const fn is_proxy_error(self) -> bool;

#[must_use]
pub const fn is_consent_error(self) -> bool;

#[must_use]
pub const fn is_fingerprint_error(self) -> bool;

#[must_use]
pub const fn is_permanent(self) -> bool;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ArsenalError {

}

#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct ErrorContext {
/// The operation that failed

#[serde(skip_serializing_if = "Option::is_none")]
pub operation: Option<String>,
/// Resource identifier (sanitized - no full paths or keys)

#[serde(skip_serializing_if = "Option::is_none")]
pub resource: Option<String>,
/// Constraint that was violated

#[serde(skip_serializing_if = "Option::is_none")]
pub constraint: Option<String>,
/// Timestamp of the error

#[serde(skip_serializing_if = "Option::is_none")]
pub timestamp: Option<chrono::DateTime<chrono::Utc>>
}

#[must_use]
pub fn new(code: ErrorCode, message: impl Into<String>) -> Self;

#[must_use]
pub fn with_correlation_id(mut self, id: Uuid) -> Self;

#[must_use]
pub fn with_context(mut self, context: ErrorContext) -> Self;

#[must_use]
pub fn with_operation(mut self, operation: impl Into<String>) -> Self;

#[must_use]
pub fn with_resource(mut self, resource: impl Into<String>) -> Self;

#[must_use]
pub const fn code(&self) -> ErrorCode;

#[must_use]
pub fn message(&self) -> &str;

#[must_use]
pub const fn correlation_id(&self) -> Option<Uuid>;

#[must_use]
pub fn context(&self) -> Option<&ErrorContext>;

#[must_use]
pub fn authentication_failed() -> Self;

#[must_use]
pub fn token_expired() -> Self;

#[must_use]
pub fn token_signature_invalid() -> Self;

#[must_use]
pub fn pop_verification_failed() -> Self;

#[must_use]
pub fn insufficient_permissions(required_scope: &str) -> Self;

#[must_use]
pub fn scope_exceeded() -> Self;

#[must_use]
pub fn policy_denied(policy_id: &str) -> Self;

#[must_use]
pub fn rate_limit_exceeded(retry_after_secs: Option<u64>) -> Self;

#[must_use]
pub fn secret_not_found() -> Self;

#[must_use]
pub fn secret_revoked() -> Self;

#[must_use]
pub fn validation_failed(field: &str, reason: &str) -> Self;

#[must_use]
pub fn internal() -> Self;

#[must_use]
pub fn token_revoked() -> Self;

#[must_use]
pub fn revocation_status_unknown() -> Self;

#[must_use]
pub fn session_expired() -> Self;

#[must_use]
pub fn proxy_destination_violation(domain: &str) -> Self;

#[must_use]
pub fn proxy_request_failed(status: u16) -> Self;

#[must_use]
pub fn ssrf_blocked() -> Self;

#[must_use]
pub fn template_variable_not_found(variable: &str) -> Self;

#[must_use]
pub fn template_variable_access_denied(variable: &str) -> Self;

#[must_use]
pub fn invalid_template_variable(name: &str) -> Self;

#[must_use]
pub fn oauth_reauth_required() -> Self;

#[must_use]
pub fn consent_required() -> Self;

#[must_use]
pub fn consent_denied() -> Self;

#[must_use]
pub fn consent_expired() -> Self;

#[must_use]
pub fn consent_revoked() -> Self;

#[must_use]
pub fn fingerprint_mismatch() -> Self;

#[must_use]
pub fn fingerprint_state_not_found() -> Self;

#[must_use]
pub fn dct_scope_amplification(variable: &str) -> Self;

#[must_use]
pub fn dct_depth_exceeded() -> Self;

#[must_use]
pub fn crypto_operation_failed() -> Self;

#[must_use]
pub fn storage_error() -> Self;

#[must_use]
pub fn configuration_error(component: &str) -> Self;

#[must_use]
pub fn invalid_state_transition(from: impl Into<String>, to: impl Into<String>) -> Self;