Merge pull request 'Update Rust crate rkyv to v0.8.15' (#156) from renovate/rkyv-0.x-lockfile into master

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "light-openid"
-version = "1.0.4"
+version = "1.1.0"
 edition = "2021"
 repository = "https://gitea.communiquons.org/pierre/light-openid"
 authors = ["Pierre HUBERT <pierre.git@communiquons.org>"]
@@ -12,16 +12,17 @@ license = "GPL-2.0-or-later"
 
 [dependencies]
 log = "0.4.21"
-reqwest = { version = "0.12.14", features = ["json"] } 
+reqwest = { version = "0.13.0", features = ["json", "form"] }
 base64 = "0.22.0"
 serde = { version = "1.0.198", features = ["derive"] }
 serde_json = "1.0.115"
 urlencoding = "2.1.3"
+thiserror = "2"
 
 # Dependencies for crypto wrapper
-bincode = { version = "2.0.0-rc.3", optional = true }
+rkyv = { version = "0.8.12", optional = true }
 aes-gcm = { version = "0.10.3", optional = true }
-rand = { version = "0.9.0", optional = true }
+rand = { version = "0.10.0", optional = true }
 
 [features]
-crypto-wrapper = ["bincode", "aes-gcm", "rand"]
+crypto-wrapper = ["rkyv", "aes-gcm", "rand"]

src/basic_state_manager.rs

@@ -6,15 +6,13 @@
 //! address of the client in an encrypted way, and expires 15
 //! minutes after issuance.
 
-use std::error::Error;
-use std::fmt;
-
 use crate::crypto_wrapper::CryptoWrapper;
+use crate::errors::OpenIdError;
 use crate::time_utils::time;
-use bincode::{Decode, Encode};
+use crate::Res;
 use std::net::IpAddr;
 
-#[derive(Encode, Decode, Debug)]
+#[derive(Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
 struct State {
     ip: IpAddr,
     expire: u64,
@@ -29,27 +27,13 @@ impl State {
     }
 }
 
-#[derive(Debug, Copy, Clone, Eq, PartialEq)]
-enum StateError {
-    InvalidIp,
-    Expired,
-}
-
-impl Error for StateError {}
-
-impl fmt::Display for StateError {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "StateManager error {self:?}")
-    }
-}
-
 /// Basic state manager. Can be used to prevent CRSF by encrypting
 /// a token containing a lifetime and the IP address of the user
 pub struct BasicStateManager(CryptoWrapper);
 
 impl BasicStateManager {
     /// Initialize the state manager by creating a random encryption key. This function
-    /// should be called only one, ideally in the main function of the application
+    /// should be called only once, ideally in the main function of the application
     pub fn new() -> Self {
         Self(CryptoWrapper::new_random())
     }
@@ -60,22 +44,22 @@ impl BasicStateManager {
     }
 
     /// Generate a new state
-    pub fn gen_state(&self, ip: IpAddr) -> Result<String, Box<dyn Error>> {
+    pub fn gen_state(&self, ip: IpAddr) -> Res<String> {
         let state = State::new(ip);
 
         self.0.encrypt(&state)
     }
 
     /// Validate given state on callback URL
-    pub fn validate_state(&self, ip: IpAddr, state: &str) -> Result<(), Box<dyn Error>> {
+    pub fn validate_state(&self, ip: IpAddr, state: &str) -> Res {
         let state: State = self.0.decrypt(state)?;
 
         if state.ip != ip {
-            return Err(Box::new(StateError::InvalidIp));
+            return Err(OpenIdError::StateErrorInvalidIP);
         }
 
         if state.expire < time() {
-            return Err(Box::new(StateError::Expired));
+            return Err(OpenIdError::StateErrorExpired);
         }
 
         Ok(())

src/client.rs

@@ -3,13 +3,13 @@
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
 use base64::Engine;
 use std::collections::HashMap;
-use std::error::Error;
 
 use crate::primitives::{OpenIDConfig, OpenIDTokenResponse, OpenIDUserInfo};
+use crate::Res;
 
 impl OpenIDConfig {
     /// Load OpenID configuration from a given .well-known/openid-configuration URL
-    pub async fn load_from_url(url: &str) -> Result<Self, Box<dyn Error>> {
+    pub async fn load_from_url(url: &str) -> Res<Self> {
         Ok(reqwest::get(url).await?.json().await?)
     }
 
@@ -37,7 +37,7 @@ impl OpenIDConfig {
         client_secret: &str,
         code: &str,
         redirect_uri: &str,
-    ) -> Result<(OpenIDTokenResponse, String), Box<dyn Error>> {
+    ) -> Res<(OpenIDTokenResponse, String)> {
         let authorization = BASE64_STANDARD.encode(format!("{client_id}:{client_secret}"));
 
         let mut params = HashMap::new();
@@ -66,7 +66,7 @@ impl OpenIDConfig {
     pub async fn request_user_info(
         &self,
         token: &OpenIDTokenResponse,
-    ) -> Result<(OpenIDUserInfo, String), Box<dyn Error>> {
+    ) -> Res<(OpenIDUserInfo, String)> {
         let response = reqwest::Client::new()
             .get(self.userinfo_endpoint.as_ref().expect(
                 "This client only support information retrieval through userinfo endpoint!",

src/crypto_wrapper.rs

@@ -1,16 +1,23 @@
+use crate::errors::OpenIdError;
+use crate::Res;
 use aes_gcm::aead::{Aead, OsRng};
 use aes_gcm::{Aes256Gcm, Key, KeyInit, Nonce};
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
 use base64::Engine as _;
-use bincode::{Decode, Encode};
 use rand::Rng;
-use std::error::Error;
+use rkyv::api::high::{HighSerializer, HighValidator};
+use rkyv::bytecheck::CheckBytes;
+use rkyv::de::Pool;
+use rkyv::rancor::Strategy;
+use rkyv::ser::allocator::ArenaHandle;
+use rkyv::util::AlignedVec;
+use rkyv::{Archive, Deserialize, Serialize};
 
-/// The lenght of the nonce used to initialize encryption
+/// The length of the nonce used to initialize encryption
 const NONCE_LEN: usize = 12;
 
 /// CryptoWrapper is a library that can be used to encrypt and decrypt some data marked
-/// that derives [Encode] and [Decode] traits using AES encryption
+/// that derives [SchemaWrite] and [SchemaRead] traits using AES encryption
 pub struct CryptoWrapper {
     key: Key<Aes256Gcm>,
 }
@@ -24,11 +31,14 @@ impl CryptoWrapper {
     }
 
     /// Encrypt some data, returning the result as a base64-encoded string
-    pub fn encrypt<T: Encode + Decode<()>>(&self, data: &T) -> Result<String, Box<dyn Error>> {
+    pub fn encrypt(
+        &self,
+        data: &impl for<'a> Serialize<HighSerializer<AlignedVec, ArenaHandle<'a>, rkyv::rancor::Error>>,
+    ) -> Res<String> {
         let aes_key = Aes256Gcm::new(&self.key);
         let nonce_bytes = rand::rng().random::<[u8; NONCE_LEN]>();
 
-        let serialized_data = bincode::encode_to_vec(data, bincode::config::standard())?;
+        let serialized_data = rkyv::to_bytes(data)?;
 
         let mut enc = aes_key
             .encrypt(Nonce::from_slice(&nonce_bytes), serialized_data.as_slice())
@@ -39,13 +49,16 @@ impl CryptoWrapper {
     }
 
     /// Decrypt some data previously encrypted using the [`CryptoWrapper::encrypt`] method
-    pub fn decrypt<T: Decode<()>>(&self, input: &str) -> Result<T, Box<dyn Error>> {
+    pub fn decrypt<T>(&self, input: &str) -> Res<T>
+    where
+        T: Archive,
+        T::Archived: for<'a> CheckBytes<HighValidator<'a, rkyv::rancor::Error>>
+            + Deserialize<T, Strategy<Pool, rkyv::rancor::Error>>,
+    {
         let bytes = BASE64_STANDARD.decode(input)?;
 
         if bytes.len() < NONCE_LEN {
-            return Err(Box::new(std::io::Error::other(
-                "Input string is smaller than nonce!",
-            )));
+            return Err(OpenIdError::DecInputStringSmallerThanNonce);
         }
 
         let (enc, nonce) = bytes.split_at(bytes.len() - NONCE_LEN);
@@ -57,22 +70,19 @@ impl CryptoWrapper {
             Ok(d) => d,
             Err(e) => {
                 log::error!("Failed to decrypt wrapped data! {e:#?}");
-                return Err(Box::new(std::io::Error::other(
-                    "Failed to decrypt wrapped data!",
-                )));
+                return Err(OpenIdError::DecryptWrappedData);
             }
         };
 
-        Ok(bincode::decode_from_slice(&dec, bincode::config::standard())?.0)
+        Ok(rkyv::from_bytes(&dec)?)
     }
 }
 
 #[cfg(test)]
 mod test {
     use crate::crypto_wrapper::CryptoWrapper;
-    use bincode::{Decode, Encode};
 
-    #[derive(Encode, Decode, Eq, PartialEq, Debug)]
+    #[derive(Eq, PartialEq, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
     struct Message(String);
 
     #[test]

src/errors.rs

@@ -0,0 +1,24 @@
+#[derive(thiserror::Error, Debug)]
+pub enum OpenIdError {
+    #[error("Reqwest error: {0}")]
+    Reqwest(#[from] reqwest::Error),
+    #[error("Serde json error: {0}")]
+    SerdeJson(#[from] serde_json::Error),
+    #[error("Base64 decoding error: {0}")]
+    Base64Decode(#[from] base64::DecodeError),
+    #[cfg(feature = "crypto-wrapper")]
+    #[error("State error: invalid IP")]
+    StateErrorInvalidIP,
+    #[cfg(feature = "crypto-wrapper")]
+    #[error("State error: expired")]
+    StateErrorExpired,
+    #[cfg(feature = "crypto-wrapper")]
+    #[error("Rkyv error: {0}")]
+    RkyvError(#[from] rkyv::rancor::Error),
+    #[cfg(feature = "crypto-wrapper")]
+    #[error("Input string is smaller than nonce!")]
+    DecInputStringSmallerThanNonce,
+    #[cfg(feature = "crypto-wrapper")]
+    #[error("Failed to decrypt wrapped data!")]
+    DecryptWrappedData,
+}

src/lib.rs

@@ -4,9 +4,14 @@
 //!
 //! See https://gitea.communiquons.org/pierre/oidc-test-client for an example of usage of this library
 
+use crate::errors::OpenIdError;
+
 pub mod client;
+pub mod errors;
 pub mod primitives;
 
+pub type Res<T = ()> = Result<T, OpenIdError>;
+
 #[cfg(feature = "crypto-wrapper")]
 mod time_utils;