Skip to content

feat: structured error codes across FFI/WASM/Python boundaries#41

Merged
bordumb merged 4 commits intomainfrom
fn-37
Mar 7, 2026
Merged

feat: structured error codes across FFI/WASM/Python boundaries#41
bordumb merged 4 commits intomainfrom
fn-37

Conversation

@bordumb
Copy link
Contributor

@bordumb bordumb commented Mar 7, 2026

Summary

  • Split VerificationError(String) into 5 structured sub-variants with unique error codes and suggestions
  • Add error_code field to Python FFI and WASM verification results
  • Replace string-matching error mappers with code-based dispatch in C FFI and Python
  • Fix pre-existing clippy errors in auths-python

Commits

  1. fn-37.1: Split VerificationError(String)IssuerSignatureFailed, DeviceSignatureFailed, AttestationExpired, AttestationRevoked, TimestampInFuture
  2. fn-37.2/37.4: Add error_code to Python VerificationResult and WASM WasmVerificationResult
  3. fn-37.3: Replace TECH-DEBT string matching in C FFI with attestation_error_to_code()
  4. fn-37.5: Replace Python _map_verify_error/_map_sign_error with code-based _map_error()
  5. Review fixes: Enum dispatch in FFI, safe JSON in WASM, correct default exception types in Python

Test plan

  • cargo nextest run --workspace — 1593 tests pass
  • cargo clippy --all-targets --all-features -- -D warnings clean
  • cargo clippy clean on auths-python
  • WASM target compiles
  • Pre-push hooks pass (fmt, clippy, unit tests, wasm-pack, cross-compile)

bordumb added 4 commits March 7, 2026 01:21
… sub-variants + fix C FFI

Replace the catch-all VerificationError(String) with 5 specific variants:
IssuerSignatureFailed, DeviceSignatureFailed, AttestationExpired,
AttestationRevoked, TimestampInFuture. Each gets a distinct error_code()
and suggestion(). Update all 11 construction sites across auths-verifier
and auths-id. Replace C FFI TECH-DEBT string matching with error_code()
dispatch via new attestation_error_to_code() helper. Add
ERR_VERIFY_FUTURE_TIMESTAMP constant. Update CLI renderer docs_url()
and tests.
…ASM verification results

Python FFI: Add error_code field to VerificationResult, populate from
AuthsErrorInfo::error_code() at all error paths. Use bracket-prefix
format [AUTHS_CODE] for exception messages.

WASM: Add error_code field to WasmVerificationResult. Change internal
verify functions to return AttestationError instead of String, preserving
typed error info. Include error_code in chain verification JSON responses.
…ased dispatch

Delete _map_verify_error() and _map_sign_error(). Add _ERROR_CODE_MAP
dict covering all AUTHS_* error codes with Python error class mappings.
Add _map_error() that parses bracket-prefix [AUTHS_CODE] format from
FFI exception messages and dispatches to the correct Python error class.
Update all call sites in _client.py.
…orrect Python exception types

- FFI: match on AttestationError variants directly instead of error_code() strings for compiler exhaustiveness
- WASM: replace hand-rolled format! JSON with serde_json::json!() to prevent malformed output
- Python: add default_cls param to _map_error(), signing paths now default to CryptoError
- Python: remove stale AUTHS_VERIFICATION_ERROR from code map, use AUTHS_ISSUER_SIG_FAILED in sign.rs
- Fix pre-existing clippy errors in auths-python: remove dead keychain-pkcs11 cfg, allow presentation-boundary Utc::now()/env::var
@vercel
Copy link

vercel bot commented Mar 7, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
auths Ready Ready Preview, Comment Mar 7, 2026 1:54am

@bordumb bordumb merged commit ab969db into main Mar 7, 2026
8 checks passed
@bordumb bordumb deleted the fn-37 branch March 7, 2026 01:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant