feat(rust): add thiserror policy lint for error types (#381)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>

Author: yordis

rsworkspace/Cargo.lock

@@ -34,6 +34,7 @@ rustls-webpki = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 sha2 = { workspace = true }
+thiserror = { workspace = true }
 time = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "signal", "sync"] }
 tracing = { workspace = true }

rsworkspace/crates/a2a-auth-callout/Cargo.toml

@@ -1,5 +1,4 @@
 use std::collections::BTreeSet;
-use std::fmt;
 use std::sync::Arc;
 
 use crate::error::AuthCalloutError;
@@ -22,23 +21,14 @@ impl RequestedAccount {
     }
 }
 
-#[derive(Debug)]
+#[derive(Debug, thiserror::Error)]
 pub enum AccountResolverError {
+    #[error("requested account must be non-empty")]
     EmptyRequest,
+    #[error("requested account {0:?} not allowlisted")]
     Unknown(String),
 }
 
-impl fmt::Display for AccountResolverError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::EmptyRequest => f.write_str("requested account must be non-empty"),
-            Self::Unknown(name) => write!(f, "requested account {name:?} not allowlisted"),
-        }
-    }
-}
-
-impl std::error::Error for AccountResolverError {}
-
 impl From<AccountResolverError> for AuthCalloutError {
     fn from(value: AccountResolverError) -> Self {
         // Variant-to-variant routing — no string matching on the failure

rsworkspace/crates/a2a-auth-callout/src/account_resolver.rs

@@ -1,5 +1,4 @@
 use std::collections::HashMap;
-use std::fmt;
 use std::sync::Arc;
 
 use hmac::{Hmac, Mac};
@@ -8,42 +7,20 @@ use sha2::Sha256;
 use crate::error::AuthCalloutError;
 use crate::jwt::{AudienceAccount, ExternalSubject, JwtError, SpiceDbPrincipal, UserJwtClaims, derive_caller_id};
 
-#[derive(Debug)]
+#[derive(Debug, thiserror::Error)]
 pub enum ApiKeyError {
+    #[error("API key must not be empty")]
     Empty,
+    #[error("API key not found in registry")]
     Unknown,
     /// `derive_caller_id` rejected the registry entry's external_subject —
     /// preserves the upstream JwtError instead of stringifying it.
-    CallerIdDerivation(JwtError),
+    #[error("API key caller_id derivation failed")]
+    CallerIdDerivation(#[source] JwtError),
     /// The caller-supplied audience didn't match the registry entry's
     /// audience for this API key.
-    AudienceMismatch {
-        requested: String,
-        registered: String,
-    },
-}
-
-impl fmt::Display for ApiKeyError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Empty => f.write_str("API key must not be empty"),
-            Self::Unknown => f.write_str("API key not found in registry"),
-            Self::CallerIdDerivation(_) => f.write_str("API key caller_id derivation failed"),
-            Self::AudienceMismatch { requested, registered } => write!(
-                f,
-                "API key audience mismatch: requested={requested:?} registered={registered:?}"
-            ),
-        }
-    }
-}
-
-impl std::error::Error for ApiKeyError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::CallerIdDerivation(e) => Some(e),
-            _ => None,
-        }
-    }
+    #[error("API key audience mismatch: requested={requested:?} registered={registered:?}")]
+    AudienceMismatch { requested: String, registered: String },
 }
 
 impl From<ApiKeyError> for AuthCalloutError {

rsworkspace/crates/a2a-auth-callout/src/credentials/api_key.rs

@@ -1,4 +1,3 @@
-use std::fmt;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use jsonwebtoken::{Algorithm, Header, encode};
@@ -12,21 +11,12 @@ use crate::jwt::SigningKey;
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct CalloutIssuer(String);
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 pub enum CalloutIssuerError {
+    #[error("callout issuer must be non-empty")]
     Empty,
 }
 
-impl fmt::Display for CalloutIssuerError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Empty => f.write_str("callout issuer must be non-empty"),
-        }
-    }
-}
-
-impl std::error::Error for CalloutIssuerError {}
-
 impl CalloutIssuer {
     pub fn new(issuer: impl Into<String>) -> Result<Self, CalloutIssuerError> {
         let s = issuer.into();
@@ -44,21 +34,12 @@ impl CalloutIssuer {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ServerAudience(String);
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 pub enum ServerAudienceError {
+    #[error("server audience must be non-empty")]
     Empty,
 }
 
-impl fmt::Display for ServerAudienceError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Empty => f.write_str("server audience must be non-empty"),
-        }
-    }
-}
-
-impl std::error::Error for ServerAudienceError {}
-
 impl ServerAudience {
     pub fn new(audience: impl Into<String>) -> Result<Self, ServerAudienceError> {
         let s = audience.into();
@@ -76,21 +57,12 @@ impl ServerAudience {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UserNkeySubject(String);
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 pub enum UserNkeySubjectError {
+    #[error("user nkey subject must be non-empty")]
     Empty,
 }
 
-impl fmt::Display for UserNkeySubjectError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Empty => f.write_str("user nkey subject must be non-empty"),
-        }
-    }
-}
-
-impl std::error::Error for UserNkeySubjectError {}
-
 impl UserNkeySubject {
     pub fn new(subject: impl Into<String>) -> Result<Self, UserNkeySubjectError> {
         let s = subject.into();
@@ -114,33 +86,16 @@ pub struct DenialClaims {
     pub request_jti: Option<String>,
 }
 
-#[derive(Debug)]
+#[derive(Debug, thiserror::Error)]
 pub enum DenialClaimsError {
-    Encode(jsonwebtoken::errors::Error),
-    SystemTime(std::time::SystemTimeError),
+    #[error("denial JWT encode error: {0}")]
+    Encode(#[source] jsonwebtoken::errors::Error),
+    #[error("system time error: {0}")]
+    SystemTime(#[source] std::time::SystemTimeError),
+    #[error("issued-at timestamp out of portable range")]
     IssuedAtOutOfRange,
 }
 
-impl fmt::Display for DenialClaimsError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Encode(e) => write!(f, "denial JWT encode error: {e}"),
-            Self::SystemTime(e) => write!(f, "system time error: {e}"),
-            Self::IssuedAtOutOfRange => f.write_str("issued-at timestamp out of portable range"),
-        }
-    }
-}
-
-impl std::error::Error for DenialClaimsError {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        match self {
-            Self::Encode(e) => Some(e),
-            Self::SystemTime(e) => Some(e),
-            _ => None,
-        }
-    }
-}
-
 impl From<DenialClaimsError> for AuthCalloutError {
     fn from(value: DenialClaimsError) -> Self {
         // Denial-claims minting failures aren't JwtError — they're this

rsworkspace/crates/a2a-auth-callout/src/denial_claims.rs

@@ -1,5 +1,3 @@
-use std::fmt;
-
 use crate::denial_category::DenialCategory;
 
 const MAX_LEN: usize = 256;
@@ -8,23 +6,14 @@ const MAX_LEN: usize = 256;
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct DenialReason(String);
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 pub enum DenialReasonError {
+    #[error("denial reason must be non-empty")]
     Empty,
+    #[error("denial reason must be at most {MAX_LEN} characters")]
     TooLong,
 }
 
-impl fmt::Display for DenialReasonError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Empty => f.write_str("denial reason must be non-empty"),
-            Self::TooLong => write!(f, "denial reason must be at most {MAX_LEN} characters"),
-        }
-    }
-}
-
-impl std::error::Error for DenialReasonError {}
-
 impl DenialReason {
     pub fn new(category: DenialCategory) -> Result<Self, DenialReasonError> {
         Self::from_wire(category.as_str())