···3434}
35353636/// Build a `NamedSource` from a name and raw bytes.
3737+pub(crate) fn named_source_from_bytes(
3838+ name: impl AsRef<str>,
3939+ bytes: Arc<[u8]>,
4040+) -> NamedSource<Arc<[u8]>> {
4141+ NamedSource::new(name, bytes)
4242+}
4343+4444+/// Build a `NamedSource` from a name and a slice.
3745///
3846/// The bytes are cloned into an `Arc<[u8]>` via miette's constructor,
3947/// so callers may drop the original slice after this returns.
4040-pub(crate) fn named_source_from_bytes(
4848+pub(crate) fn named_source_from_slice(
4149 name: impl AsRef<str>,
4250 bytes: &[u8],
4351) -> NamedSource<Arc<[u8]>> {
4452 NamedSource::new(name, Arc::<[u8]>::from(bytes))
4545-}
4646-4747-/// Build a `NamedSource` from a name and a UTF-8 string slice.
4848-pub(crate) fn named_source_from_str(name: impl AsRef<str>, text: &str) -> NamedSource<String> {
4949- NamedSource::new(name, text.to_string())
5053}
51545255/// Pretty-print `body` as JSON for display in a `NamedSource`.
+24-10
src/common/jwt.rs
···1212use serde::{Deserialize, Serialize};
1313use thiserror::Error;
14141515-use crate::common::identity::{AnySignatureError, AnySigningKey};
1515+use crate::common::identity::AnySigningKey;
16161717#[cfg(test)]
1818-use crate::common::identity::{AnySignature, AnyVerifyingKey};
1818+use crate::common::identity::{AnySignature, AnySignatureError, AnyVerifyingKey};
19192020/// Compact JWS header for atproto service-auth tokens.
2121///
···6868 pub jti: String,
6969}
70707171-/// Errors from JWT encode/decode.
7171+/// Errors from JWT encode.
7272///
7373/// **Not user-rendered:** these errors only surface inside tests and
7474/// library helpers. They deliberately do NOT derive `miette::Diagnostic`
···7878/// rendered to the user, they must wrap it in a stage-local diagnostic
7979/// with a proper `code = "labeler::..."` string.
8080#[derive(Debug, Error)]
8181+pub(crate) enum EncodeError {
8282+ /// JSON serialization of header or claims failed (should not happen for
8383+ /// well-formed structs).
8484+ #[error("JSON encode failed")]
8585+ JsonEncode(serde_json::Error),
8686+}
8787+8888+/// Errors from JWT decode.
8989+///
9090+/// **Not user-rendered:** these errors only surface inside tests and
9191+/// library helpers. They deliberately do NOT derive `miette::Diagnostic`
9292+/// with stable codes — the stage converts any failure into a
9393+/// `CreateReportStageError::Transport` or a specific check SpecViolation
9494+/// before rendering. If a future caller needs one of these variants
9595+/// rendered to the user, they must wrap it in a stage-local diagnostic
9696+/// with a proper `code = "labeler::..."` string.
9797+#[cfg(test)]
9898+#[derive(Debug, Error)]
8199pub(crate) enum JwtError {
82100 /// Compact form was not three `.`-separated base64url segments.
83101 #[error("malformed compact JWT: expected three segments")]
···100118 #[source]
101119 source: serde_json::Error,
102120 },
103103- /// JSON serialization of header or claims failed (should not happen for
104104- /// well-formed structs).
105105- #[error("JSON encode failed")]
106106- JsonEncode(serde_json::Error),
107121 /// Signature was not exactly 64 bytes.
108122 #[error("signature was {actual} bytes; expected 64")]
109123 SignatureLength {
···133147 header: &JwtHeader,
134148 claims: &JwtClaims,
135149 signer: &AnySigningKey,
136136-) -> Result<String, JwtError> {
137137- let header_json = serde_json::to_vec(header).map_err(JwtError::JsonEncode)?;
138138- let claims_json = serde_json::to_vec(claims).map_err(JwtError::JsonEncode)?;
150150+) -> Result<String, EncodeError> {
151151+ let header_json = serde_json::to_vec(header).map_err(EncodeError::JsonEncode)?;
152152+ let claims_json = serde_json::to_vec(claims).map_err(EncodeError::JsonEncode)?;
139153 let header_b64 = URL_SAFE_NO_PAD.encode(&header_json);
140154 let claims_b64 = URL_SAFE_NO_PAD.encode(&claims_json);
141155 let signing_input = format!("{header_b64}.{claims_b64}");