OpenMFA/crates/http-api/src/lib.rs

//! HTTP surface: the JSON API, the embedded UI, and the auth gate.
#![forbid(unsafe_code)]

pub mod app;
pub mod auth;
pub mod qr;
pub mod state;

pub use app::router;
pub use state::AppState;

use axum::{
    http::StatusCode,
    response::{IntoResponse, Response},
    Json,
};

/// Map a domain error onto an HTTP response.
///
/// The message is written to be shown verbatim in a toast, so this keeps
/// whatever `openmfa-core` said rather than substituting a generic one —
/// with the exception of crypto failures, whose detail goes to the log
/// instead of the browser.
pub fn error_response(e: &openmfa_core::Error) -> Response {
    use openmfa_core::Error;
    let (status, message) = match e {
        Error::Invalid(m) => (StatusCode::BAD_REQUEST, m.clone()),
        Error::NotFound(_) => (StatusCode::NOT_FOUND, e.to_string()),
        Error::Conflict(m) => (StatusCode::CONFLICT, m.clone()),
        Error::Crypto(detail) => {
            tracing::error!(target: "openmfa::http", "cryptography error: {detail}");
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                "the vault could not be read — check the server log".to_string(),
            )
        }
        Error::Io(detail) => {
            tracing::error!(target: "openmfa::http", "i/o error: {detail}");
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                "could not write to disk — check the server log".to_string(),
            )
        }
        other => {
            tracing::error!(target: "openmfa::http", "unexpected error: {other}");
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                "something went wrong — check the server log".to_string(),
            )
        }
    };
    (status, Json(serde_json::json!({ "error": message }))).into_response()
}