net/device_bound_sessions/session_error.cc

// Copyright 2025 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "net/device_bound_sessions/session_error.h"

#include <optional>

#include "base/notreached.h"
#include "net/device_bound_sessions/refresh_result.h"

namespace net::device_bound_sessions {

SessionError::SessionError(SessionError::ErrorType type) : type(type) {}

SessionError::~SessionError() = default;

SessionError::SessionError(SessionError&&) noexcept = default;
SessionError& SessionError::operator=(SessionError&&) noexcept = default;

std::optional<DeletionReason> SessionError::GetDeletionReason() const {
  switch (type) {
    case kSuccess:
      return std::nullopt;
    case kServerRequestedTermination:
      return DeletionReason::kServerRequested;
    case kSigningError:
    case kPersistentHttpError:
    case kInvalidChallenge:
    case kTooManyChallenges:
    case kSessionDeletedDuringRefresh:
      return DeletionReason::kRefreshFatalError;
    case kInvalidConfigJson:
    case kInvalidSessionId:
    case kInvalidCredentialsConfig:
    case kInvalidCredentialsType:
    case kInvalidCredentialsEmptyName:
    case kInvalidCredentialsCookie:
    case kInvalidCredentialsCookieCreationTime:
    case kInvalidCredentialsCookieName:
    case kInvalidCredentialsCookieParsing:
    case kInvalidCredentialsCookieUnpermittedAttribute:
    case kInvalidCredentialsCookieInvalidDomain:
    case kInvalidCredentialsCookiePrefix:
    case kInvalidFetcherUrl:
    case kInvalidRefreshUrl:
    case kScopeOriginSameSiteMismatch:
    case kRefreshUrlSameSiteMismatch:
    case kInvalidScopeOrigin:
    case kScopeOriginContainsPath:
    case kMismatchedSessionId:
    case kRefreshInitiatorNotString:
    case kRefreshInitiatorInvalidHostPattern:
    case kInvalidScopeRulePath:
    case kInvalidScopeRuleHostPattern:
    case kScopeRuleOriginScopedHostPatternMismatch:
    case kScopeRuleSiteScopedHostPatternMismatch:
    case kInvalidScopeSpecification:
    case kMissingScopeSpecificationType:
    case kEmptyScopeSpecificationDomain:
    case kEmptyScopeSpecificationPath:
    case kInvalidScopeSpecificationType:
    case kMissingScope:
    case kNoCredentials:
    case kInvalidScopeIncludeSite:
    case kMissingScopeIncludeSite:
      return DeletionReason::kInvalidSessionParams;
    case kNetError:
    case kProxyError:
    case kTransientHttpError:
    case kBoundCookieSetForbidden:
    case kSigningQuotaExceeded:
    case kTransientSigningError:
      return std::nullopt;
    // Registration-only errors never trigger session deletion.
    case kSigningKeyGenerationError:
    case kAttestationKeyGenerationError:
    case kSubdomainRegistrationWellKnownUnavailable:
    case kSubdomainRegistrationUnauthorized:
    case kSubdomainRegistrationWellKnownMalformed:
    case kFederatedNotAuthorizedByProvider:
    case kFederatedNotAuthorizedByRelyingParty:
    case kSessionProviderWellKnownUnavailable:
    case kSessionProviderWellKnownMalformed:
    case kSessionProviderWellKnownHasProviderOrigin:
    case kRelyingPartyWellKnownUnavailable:
    case kRelyingPartyWellKnownMalformed:
    case kRelyingPartyWellKnownHasRelyingOrigins:
    case kFederatedKeyThumbprintMismatch:
    case kInvalidFederatedSessionUrl:
    case kInvalidFederatedSessionProviderSessionMissing:
    case kInvalidFederatedSessionWrongProviderOrigin:
    case kInvalidFederatedKey:
    case kTooManyRelyingOriginLabels:
    case kEmptySessionConfig:
    case kRegistrationAttemptedChallenge:
    case kInvalidFederatedSessionProviderFailedToRestoreKey:
    case kFailedToUnwrapKey:
    case kCrossOriginRegistrationSiteNotIncluded:
    case kInvalidPreProvisionedKeyInitiatorMissing:
    case kPreProvisionedKeyAccessNotGranted:
    case kPreProvisionedKeyNotFound:
    case kAttestationCertificationError:
    case kAttestationSigningError:
      NOTREACHED();
  }
}

bool SessionError::IsServerError() const {
  switch (type) {
    case kSuccess:
    case kSigningError:
    case kNetError:
    case kProxyError:
    case kSigningQuotaExceeded:
    case kSessionDeletedDuringRefresh:
    case kTransientSigningError:
      return false;
    case kServerRequestedTermination:
    case kInvalidConfigJson:
    case kInvalidSessionId:
    case kInvalidCredentialsConfig:
    case kInvalidCredentialsType:
    case kInvalidCredentialsEmptyName:
    case kInvalidCredentialsCookie:
    case kInvalidCredentialsCookieCreationTime:
    case kInvalidCredentialsCookieName:
    case kInvalidCredentialsCookieParsing:
    case kInvalidCredentialsCookieUnpermittedAttribute:
    case kInvalidCredentialsCookieInvalidDomain:
    case kInvalidCredentialsCookiePrefix:
    case kInvalidChallenge:
    case kTooManyChallenges:
    case kInvalidFetcherUrl:
    case kInvalidRefreshUrl:
    case kPersistentHttpError:
    case kScopeOriginSameSiteMismatch:
    case kRefreshUrlSameSiteMismatch:
    case kInvalidScopeOrigin:
    case kScopeOriginContainsPath:
    case kTransientHttpError:
    case kMismatchedSessionId:
    case kRefreshInitiatorNotString:
    case kRefreshInitiatorInvalidHostPattern:
    case kInvalidScopeRulePath:
    case kInvalidScopeRuleHostPattern:
    case kScopeRuleOriginScopedHostPatternMismatch:
    case kScopeRuleSiteScopedHostPatternMismatch:
    case kInvalidScopeSpecification:
    case kMissingScopeSpecificationType:
    case kEmptyScopeSpecificationDomain:
    case kEmptyScopeSpecificationPath:
    case kInvalidScopeSpecificationType:
    case kMissingScope:
    case kNoCredentials:
    case kInvalidScopeIncludeSite:
    case kMissingScopeIncludeSite:
    case kBoundCookieSetForbidden:
      return true;
    // Registration-only errors never get reported to the server.
    case kSigningKeyGenerationError:
    case kAttestationKeyGenerationError:
    case kSubdomainRegistrationWellKnownUnavailable:
    case kSubdomainRegistrationUnauthorized:
    case kSubdomainRegistrationWellKnownMalformed:
    case kFederatedNotAuthorizedByProvider:
    case kFederatedNotAuthorizedByRelyingParty:
    case kSessionProviderWellKnownUnavailable:
    case kSessionProviderWellKnownMalformed:
    case kSessionProviderWellKnownHasProviderOrigin:
    case kRelyingPartyWellKnownUnavailable:
    case kRelyingPartyWellKnownMalformed:
    case kRelyingPartyWellKnownHasRelyingOrigins:
    case kFederatedKeyThumbprintMismatch:
    case kInvalidFederatedSessionUrl:
    case kInvalidFederatedSessionProviderSessionMissing:
    case kInvalidFederatedSessionWrongProviderOrigin:
    case kInvalidFederatedKey:
    case kTooManyRelyingOriginLabels:
    case kEmptySessionConfig:
    case kRegistrationAttemptedChallenge:
    case kInvalidFederatedSessionProviderFailedToRestoreKey:
    case kFailedToUnwrapKey:
    case kCrossOriginRegistrationSiteNotIncluded:
    case kInvalidPreProvisionedKeyInitiatorMissing:
    case kPreProvisionedKeyAccessNotGranted:
    case kPreProvisionedKeyNotFound:
    case kAttestationCertificationError:
    case kAttestationSigningError:
      NOTREACHED();
  }
}

std::optional<RefreshResult> SessionError::GetRefreshResult() const {
  switch (type) {
    case kSuccess:
      return std::nullopt;
    // Fatal cases
    case kServerRequestedTermination:
    case kSigningError:
    case kPersistentHttpError:
    case kInvalidChallenge:
    case kTooManyChallenges:
    case kSessionDeletedDuringRefresh:
    case kInvalidConfigJson:
    case kInvalidSessionId:
    case kInvalidCredentialsConfig:
    case kInvalidCredentialsType:
    case kInvalidCredentialsEmptyName:
    case kInvalidCredentialsCookie:
    case kInvalidCredentialsCookieCreationTime:
    case kInvalidCredentialsCookieName:
    case kInvalidCredentialsCookieParsing:
    case kInvalidCredentialsCookieUnpermittedAttribute:
    case kInvalidCredentialsCookieInvalidDomain:
    case kInvalidCredentialsCookiePrefix:
    case kInvalidFetcherUrl:
    case kInvalidRefreshUrl:
    case kScopeOriginSameSiteMismatch:
    case kRefreshUrlSameSiteMismatch:
    case kInvalidScopeOrigin:
    case kScopeOriginContainsPath:
    case kMismatchedSessionId:
    case kRefreshInitiatorNotString:
    case kRefreshInitiatorInvalidHostPattern:
    case kInvalidScopeRulePath:
    case kInvalidScopeRuleHostPattern:
    case kScopeRuleOriginScopedHostPatternMismatch:
    case kScopeRuleSiteScopedHostPatternMismatch:
    case kInvalidScopeSpecification:
    case kMissingScopeSpecificationType:
    case kEmptyScopeSpecificationDomain:
    case kEmptyScopeSpecificationPath:
    case kInvalidScopeSpecificationType:
    case kMissingScope:
    case kNoCredentials:
    case kInvalidScopeIncludeSite:
    case kMissingScopeIncludeSite:
      return RefreshResult::kFatalError;

    // Specific cases
    case kSigningQuotaExceeded:
      return RefreshResult::kSigningQuotaExceeded;
    case kTransientSigningError:
      return RefreshResult::kTransientSigningError;

    // Server errors (non-fatal)
    case kTransientHttpError:
    case kBoundCookieSetForbidden:
      return RefreshResult::kServerError;

    // Unreachable/Other
    case kNetError:
    case kProxyError:
      return RefreshResult::kUnreachable;

    // Registration-only errors
    case kSigningKeyGenerationError:
    case kAttestationKeyGenerationError:
    case kSubdomainRegistrationWellKnownUnavailable:
    case kSubdomainRegistrationUnauthorized:
    case kSubdomainRegistrationWellKnownMalformed:
    case kFederatedNotAuthorizedByProvider:
    case kFederatedNotAuthorizedByRelyingParty:
    case kSessionProviderWellKnownUnavailable:
    case kSessionProviderWellKnownMalformed:
    case kSessionProviderWellKnownHasProviderOrigin:
    case kRelyingPartyWellKnownUnavailable:
    case kRelyingPartyWellKnownMalformed:
    case kRelyingPartyWellKnownHasRelyingOrigins:
    case kFederatedKeyThumbprintMismatch:
    case kInvalidFederatedSessionUrl:
    case kInvalidFederatedSessionProviderSessionMissing:
    case kInvalidFederatedSessionWrongProviderOrigin:
    case kInvalidFederatedKey:
    case kTooManyRelyingOriginLabels:
    case kEmptySessionConfig:
    case kRegistrationAttemptedChallenge:
    case kInvalidFederatedSessionProviderFailedToRestoreKey:
    case kFailedToUnwrapKey:
    case kCrossOriginRegistrationSiteNotIncluded:
    case kInvalidPreProvisionedKeyInitiatorMissing:
    case kPreProvisionedKeyAccessNotGranted:
    case kPreProvisionedKeyNotFound:
    case kAttestationCertificationError:
    case kAttestationSigningError:
      NOTREACHED();
  }
}

}  // namespace net::device_bound_sessions