archetech / archon / 28630230441

92%

main: 92%

Pull #685

github

feat(rust-gatekeeper): return 500 internalError on unexpected resolution failure (#679)

The conformant /1.0/identifiers surface previously mapped every resolution
error to notFound/invalidDid — it never emitted 500, unlike the TS reference,
so genuine internal failures (I/O, storage, crypto) were masked as notFound.
Spec §2.6 had softened this to SHOULD to accommodate the gap.

Introduce a typed `ResolveError { NotFound, InvalidOperation }` in the resolver
and tag `resolve_local_doc_async`'s own expected-failure sites with it (its bail
messages are preserved via Display, so log readers and — importantly — the
import state machine, which treats any verify Err as Deferred without matching
strings, are unaffected). Verify-layer errors are normalized by `tag_verify_error`:
a recursive resolve keeps its typed error, the verify functions' own
"Invalid operation: ..." validation bails are tagged InvalidOperation, and
anything else propagates untyped.

`classify_conformant_error(did, error)` then maps: malformed DID -> 400
invalidDid; a ResolveError anywhere in the cause chain -> 404 notFound; anything
else -> 500 internalError. Used by resolve_conformant. Now matches the TS
behavior, so spec §2.6 is tightened back to MUST.

Unit-tested (classify_conformant_error across invalidDid / notFound / chained /
internal). Build + clippy clean.

Note: `cargo test --lib` also shows the pre-existing verify_event_shape failure,
which is unrelated and fixed by #682 — merge that (or rebase) for a fully green
lib run.

Closes #679.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2816 of 3323 branches covered (84.74%)

Branch coverage included in aggregate %.

5851 of 6142 relevant lines covered (95.26%)

882.15 hits per line