feat: refactor errors

james-d-elliott · james-d-elliott · commit e582e2c8f51a · 2025-01-25T11:59:50.000+11:00
diff --git a/metadata/const.go b/metadata/const.go
@@ -20,15 +20,15 @@ const (
 )
 
 var (
-	errIntermediateCertRevoked = &MetadataError{
+	errIntermediateCertRevoked = &Error{
 		Type:    "intermediate_revoked",
 		Details: "Intermediate certificate is on issuers revocation list",
 	}
-	errLeafCertRevoked = &MetadataError{
+	errLeafCertRevoked = &Error{
 		Type:    "leaf_revoked",
 		Details: "Leaf certificate is on issuers revocation list",
 	}
-	errCRLUnavailable = &MetadataError{
+	errCRLUnavailable = &Error{
 		Type:    "crl_unavailable",
 		Details: "Certificate revocation list is unavailable",
 	}
diff --git a/metadata/metadata_test.go b/metadata/metadata_test.go
@@ -82,7 +82,7 @@ func TestConformanceMetadataTOCParsing(t *testing.T) {
 	var (
 		res  *http.Response
 		blob *PayloadJSON
-		me   *MetadataError
+		me   *Error
 	)
 
 	for _, endpoint := range endpoints {
diff --git a/metadata/status.go b/metadata/status.go
@@ -44,17 +44,17 @@ func ValidateStatusReports(reports []StatusReport, desired, undesired []Authenti
 	case len(present) == 0 && len(absent) == 0:
 		return nil
 	case len(present) != 0 && len(absent) == 0:
-		return &MetadataError{
+		return &Error{
 			Type:    "invalid_status",
 			Details: fmt.Sprintf("The following undesired status reports were present: %s", strings.Join(present, ", ")),
 		}
 	case len(present) == 0 && len(absent) != 0:
-		return &MetadataError{
+		return &Error{
 			Type:    "invalid_status",
 			Details: fmt.Sprintf("The following desired status reports were absent: %s", strings.Join(absent, ", ")),
 		}
 	default:
-		return &MetadataError{
+		return &Error{
 			Type:    "invalid_status",
 			Details: fmt.Sprintf("The following undesired status reports were present: %s; the following desired status reports were absent: %s", strings.Join(present, ", "), strings.Join(absent, ", ")),
 		}
diff --git a/metadata/types.go b/metadata/types.go
@@ -299,7 +299,7 @@ const (
 	ALG_KEY_COSE PublicKeyAlgAndEncoding = "cose"
 )
 
-type MetadataError struct {
+type Error struct {
 	// Short name for the type of error that has occurred.
 	Type string `json:"type"`
 
@@ -310,8 +310,8 @@ type MetadataError struct {
 	DevInfo string `json:"debug"`
 }
 
-func (err *MetadataError) Error() string {
-	return err.Details
+func (e *Error) Error() string {
+	return e.Details
 }
 
 // Clock is an interface used to implement clock functionality in various metadata areas.
diff --git a/protocol/assertion.go b/protocol/assertion.go
@@ -69,7 +69,7 @@ func ParseCredentialRequestResponseBody(body io.Reader) (par *ParsedCredentialAs
 	var car CredentialAssertionResponse
 
 	if err = decodeBody(body, &car); err != nil {
-		return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error())
+		return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error()).WithError(err)
 	}
 
 	return car.Parse()
@@ -81,7 +81,7 @@ func ParseCredentialRequestResponseBytes(data []byte) (par *ParsedCredentialAsse
 	var car CredentialAssertionResponse
 
 	if err = decodeBytes(data, &car); err != nil {
-		return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error())
+		return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error()).WithError(err)
 	}
 
 	return car.Parse()
@@ -97,7 +97,7 @@ func (car CredentialAssertionResponse) Parse() (par *ParsedCredentialAssertionDa
 	}
 
 	if _, err = base64.RawURLEncoding.DecodeString(car.ID); err != nil {
-		return nil, ErrBadRequest.WithDetails("CredentialAssertionResponse with ID not base64url encoded")
+		return nil, ErrBadRequest.WithDetails("CredentialAssertionResponse with ID not base64url encoded").WithError(err)
 	}
 
 	if car.Type != string(PublicKeyCredentialType) {
@@ -129,7 +129,7 @@ func (car CredentialAssertionResponse) Parse() (par *ParsedCredentialAssertionDa
 	}
 
 	if err = par.Response.AuthenticatorData.Unmarshal(car.AssertionResponse.AuthenticatorData); err != nil {
-		return nil, ErrParsingData.WithDetails("Error unmarshalling auth data")
+		return nil, ErrParsingData.WithDetails("Error unmarshalling auth data").WithError(err)
 	}
 
 	return par, nil
@@ -189,12 +189,12 @@ func (p *ParsedCredentialAssertionData) Verify(storedChallenge string, relyingPa
 	}
 
 	if err != nil {
-		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error parsing the assertion public key: %+v", err))
+		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error parsing the assertion public key: %+v", err)).WithError(err)
 	}
 
 	valid, err := webauthncose.VerifySignature(key, sigData, p.Response.Signature)
 	if !valid || err != nil {
-		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error validating the assertion signature: %+v", err))
+		return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error validating the assertion signature: %+v", err)).WithError(err)
 	}
 
 	return nil
diff --git a/protocol/attestation.go b/protocol/attestation.go
@@ -94,18 +94,18 @@ func (ccr *AuthenticatorAttestationResponse) Parse() (p *ParsedAttestationRespon
 	p = &ParsedAttestationResponse{}
 
 	if err = json.Unmarshal(ccr.ClientDataJSON, &p.CollectedClientData); err != nil {
-		return nil, ErrParsingData.WithInfo(err.Error())
+		return nil, ErrParsingData.WithInfo(err.Error()).WithError(err)
 	}
 
 	if err = webauthncbor.Unmarshal(ccr.AttestationObject, &p.AttestationObject); err != nil {
-		return nil, ErrParsingData.WithInfo(err.Error())
+		return nil, ErrParsingData.WithInfo(err.Error()).WithError(err)
 	}
 
 	// Step 8. Perform CBOR decoding on the attestationObject field of the AuthenticatorAttestationResponse
 	// structure to obtain the attestation statement format fmt, the authenticator data authData, and
 	// the attestation statement attStmt.
 	if err = p.AttestationObject.AuthData.Unmarshal(p.AttestationObject.RawAuthData); err != nil {
-		return nil, fmt.Errorf("error decoding auth data: %v", err)
+		return nil, err
 	}
 
 	if !p.AttestationObject.AuthData.Flags.HasAttestedCredentialData() {
@@ -176,7 +176,7 @@ func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadat
 
 	if len(a.AuthData.AttData.AAGUID) != 0 {
 		if aaguid, err = uuid.FromBytes(a.AuthData.AttData.AAGUID); err != nil {
-			return ErrInvalidAttestation.WithInfo("Error occurred parsing AAGUID during attestation validation").WithDetails(err.Error())
+			return ErrInvalidAttestation.WithInfo("Error occurred parsing AAGUID during attestation validation").WithDetails(err.Error()).WithError(err)
 		}
 	}
 
@@ -187,7 +187,7 @@ func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadat
 	var protoErr *Error
 
 	if protoErr = ValidateMetadata(context.Background(), mds, aaguid, attestationType, x5cs); protoErr != nil {
-		return ErrInvalidAttestation.WithInfo(fmt.Sprintf("Error occurred validating metadata during attestation validation: %+v", protoErr)).WithDetails(protoErr.DevInfo)
+		return ErrInvalidAttestation.WithInfo(fmt.Sprintf("Error occurred validating metadata during attestation validation: %+v", protoErr)).WithDetails(protoErr.DevInfo).WithError(protoErr)
 	}
 
 	return nil
diff --git a/protocol/attestation_androidkey.go b/protocol/attestation_androidkey.go
@@ -65,25 +65,25 @@ func verifyAndroidKeyFormat(att AttestationObject, clientDataHash []byte, _ meta
 
 	attCert, err := x509.ParseCertificate(attCertBytes)
 	if err != nil {
-		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err))
+		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)
 	}
 
 	coseAlg := webauthncose.COSEAlgorithmIdentifier(alg)
 	if err = attCert.CheckSignature(webauthncose.SigAlgFromCOSEAlg(coseAlg), signatureData, sig); err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err)).WithError(err)
 	}
 
 	// Verify that the public key in the first certificate in x5c matches the credentialPublicKey in the attestedCredentialData in authenticatorData.
 	pubKey, err := webauthncose.ParsePublicKey(att.AuthData.AttData.CredentialPublicKey)
 	if err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err)).WithError(err)
 	}
 
 	e := pubKey.(webauthncose.EC2PublicKeyData)
 
 	valid, err = e.Verify(signatureData, sig)
 	if err != nil || !valid {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err)).WithError(err)
 	}
 
 	// §8.4.3. Verify that the attestationChallenge field in the attestation certificate extension data is identical to clientDataHash.
@@ -105,11 +105,11 @@ func verifyAndroidKeyFormat(att AttestationObject, clientDataHash []byte, _ meta
 	decoded := keyDescription{}
 
 	if _, err = asn1.Unmarshal(attExtBytes, &decoded); err != nil {
-		return "", nil, ErrAttestationFormat.WithDetails("Unable to parse Android key attestation certificate extensions")
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to parse Android key attestation certificate extensions").WithError(err)
 	}
 
 	// Verify that the attestationChallenge field in the attestation certificate extension data is identical to clientDataHash.
-	if 0 != bytes.Compare(decoded.AttestationChallenge, clientDataHash) {
+	if bytes.Compare(decoded.AttestationChallenge, clientDataHash) != 0 {
 		return "", nil, ErrAttestationFormat.WithDetails("Attestation challenge not equal to clientDataHash")
 	}
 
diff --git a/protocol/attestation_apple.go b/protocol/attestation_apple.go
@@ -48,7 +48,7 @@ func verifyAppleFormat(att AttestationObject, clientDataHash []byte, _ metadata.
 
 	credCert, err := x509.ParseCertificate(credCertBytes)
 	if err != nil {
-		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err))
+		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)
 	}
 
 	// Step 2. Concatenate authenticatorData and clientDataHash to form nonceToHash.
@@ -73,7 +73,7 @@ func verifyAppleFormat(att AttestationObject, clientDataHash []byte, _ metadata.
 	decoded := AppleAnonymousAttestation{}
 
 	if _, err = asn1.Unmarshal(attExtBytes, &decoded); err != nil {
-		return "", nil, ErrAttestationFormat.WithDetails("Unable to parse apple attestation certificate extensions")
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to parse apple attestation certificate extensions").WithError(err)
 	}
 
 	if !bytes.Equal(decoded.Nonce, nonce[:]) {
@@ -84,7 +84,7 @@ func verifyAppleFormat(att AttestationObject, clientDataHash []byte, _ metadata.
 	// TODO: Probably move this part to webauthncose.go
 	pubKey, err := webauthncose.ParsePublicKey(att.AuthData.AttData.CredentialPublicKey)
 	if err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err)).WithError(err)
 	}
 
 	credPK := pubKey.(webauthncose.EC2PublicKeyData)
diff --git a/protocol/attestation_packed.go b/protocol/attestation_packed.go
@@ -81,7 +81,7 @@ func handleBasicAttestation(signature, clientDataHash, authData, aaguid []byte,
 
 		ct, err := x509.ParseCertificate(cb)
 		if err != nil {
-			return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err))
+			return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)
 		}
 
 		if ct.NotBefore.After(time.Now()) || ct.NotAfter.Before(time.Now()) {
@@ -98,12 +98,12 @@ func handleBasicAttestation(signature, clientDataHash, authData, aaguid []byte,
 
 	attCert, err := x509.ParseCertificate(attCertBytes)
 	if err != nil {
-		return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err))
+		return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)
 	}
 
 	coseAlg := webauthncose.COSEAlgorithmIdentifier(alg)
 	if err = attCert.CheckSignature(webauthncose.SigAlgFromCOSEAlg(coseAlg), signatureData, signature); err != nil {
-		return "", x5c, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err))
+		return "", x5c, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err)).WithError(err)
 	}
 
 	// Step 2.2 Verify that attestnCert meets the requirements in §8.2.1 Packed attestation statement certificate requirements.
diff --git a/protocol/attestation_safetynet.go b/protocol/attestation_safetynet.go
@@ -90,14 +90,14 @@ func verifySafetyNetFormat(att AttestationObject, clientDataHash []byte, mds met
 	})
 
 	if err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
 	}
 
 	// marshall the JWT payload into the safetynet response json
 	var safetyNetResponse SafetyNetResponse
 
 	if err = mapstructure.Decode(token.Claims, &safetyNetResponse); err != nil {
-		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing the SafetyNet response: %+v", err))
+		return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing the SafetyNet response: %+v", err)).WithError(err)
 	}
 
 	// §8.5.3 Verify that the nonce in the response is identical to the Base64 encoding of the SHA-256 hash of the concatenation
@@ -106,7 +106,7 @@ func verifySafetyNetFormat(att AttestationObject, clientDataHash []byte, mds met
 
 	nonceBytes, err := base64.StdEncoding.DecodeString(safetyNetResponse.Nonce)
 	if !bytes.Equal(nonceBuffer[:], nonceBytes) || err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails("Invalid nonce for in SafetyNet response")
+		return "", nil, ErrInvalidAttestation.WithDetails("Invalid nonce for in SafetyNet response").WithError(err)
 	}
 
 	// §8.5.4 Let attestationCert be the attestation certificate (https://www.w3.org/TR/webauthn/#attestation-certificate)
@@ -115,18 +115,18 @@ func verifySafetyNetFormat(att AttestationObject, clientDataHash []byte, mds met
 
 	n, err := base64.StdEncoding.Decode(l, []byte(certChain[0].(string)))
 	if err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
 	}
 
 	attestationCert, err := x509.ParseCertificate(l[:n])
 	if err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
 	}
 
 	// §8.5.5 Verify that attestationCert is issued to the hostname "attest.android.com"
 	err = attestationCert.VerifyHostname("attest.android.com")
 	if err != nil {
-		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err))
+		return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error finding cert issued to correct hostname: %+v", err)).WithError(err)
 	}
 
 	// §8.5.6 Verify that the ctsProfileMatch attribute in the payload of response is true.
diff --git a/protocol/attestation_tpm.go b/protocol/attestation_tpm.go
@@ -72,7 +72,7 @@ func verifyTPMFormat(att AttestationObject, clientDataHash []byte, _ metadata.Pr
 	// is identical to the credentialPublicKey in the attestedCredentialData in authenticatorData.
 	pubArea, err := tpm2.DecodePublic(pubAreaBytes)
 	if err != nil {
-		return "", nil, ErrAttestationFormat.WithDetails("Unable to decode TPMT_PUBLIC in attestation statement")
+		return "", nil, ErrAttestationFormat.WithDetails("Unable to decode TPMT_PUBLIC in attestation statement").WithError(err)
 	}
 
 	key, err := webauthncose.ParsePublicKey(att.AuthData.AttData.CredentialPublicKey)
@@ -394,7 +394,7 @@ func tpmParseSANExtension(attestation *x509.Certificate) (protoErr *Error) {
 	for _, ext := range attestation.Extensions {
 		if ext.Id.Equal(oidExtensionSubjectAltName) {
 			if manufacturer, model, version, err = parseSANExtension(ext.Value); err != nil {
-				return ErrInvalidAttestation.WithDetails("Authenticator with invalid Authenticator Identity Key SAN data encountered during attestation validation.").WithInfo(fmt.Sprintf("Error occurred parsing SAN extension: %s", err.Error()))
+				return ErrInvalidAttestation.WithDetails("Authenticator with invalid Authenticator Identity Key SAN data encountered during attestation validation.").WithInfo(fmt.Sprintf("Error occurred parsing SAN extension: %s", err.Error())).WithError(err)
 			}
 		}
 	}
diff --git a/protocol/attestation_u2f.go b/protocol/attestation_u2f.go
@@ -76,7 +76,7 @@ func verifyU2FFormat(att AttestationObject, clientDataHash []byte, _ metadata.Pr
 
 	attCert, err := x509.ParseCertificate(asn1Bytes)
 	if err != nil {
-		return "", nil, ErrAttestationFormat.WithDetails("Error parsing certificate from ASN.1 data into certificate")
+		return "", nil, ErrAttestationFormat.WithDetails("Error parsing certificate from ASN.1 data into certificate").WithError(err)
 	}
 
 	// Step 2.3
diff --git a/protocol/authenticator.go b/protocol/authenticator.go
@@ -349,7 +349,7 @@ func (a *AuthenticatorData) unmarshalAttestedData(rawAuthData []byte) (err error
 
 	a.AttData.CredentialPublicKey, err = unmarshalCredentialPublicKey(rawAuthData[55+idLength:])
 	if err != nil {
-		return ErrBadRequest.WithDetails(fmt.Sprintf("Could not unmarshal Credential Public Key: %v", err))
+		return ErrBadRequest.WithDetails(fmt.Sprintf("Could not unmarshal Credential Public Key: %v", err)).WithError(err)
 	}
 
 	return nil
diff --git a/protocol/client.go b/protocol/client.go
@@ -111,7 +111,7 @@ func (c *CollectedClientData) Verify(storedChallenge string, ceremony CeremonyTy
 	var fqOrigin string
 
 	if fqOrigin, err = FullyQualifiedOrigin(c.Origin); err != nil {
-		return ErrParsingData.WithDetails("Error decoding clientData origin as URL")
+		return ErrParsingData.WithDetails("Error decoding clientData origin as URL").WithError(err)
 	}
 
 	found := false
@@ -146,7 +146,7 @@ func (c *CollectedClientData) Verify(storedChallenge string, ceremony CeremonyTy
 			)
 
 			if fqTopOrigin, err = FullyQualifiedOrigin(c.TopOrigin); err != nil {
-				return ErrParsingData.WithDetails("Error decoding clientData topOrigin as URL")
+				return ErrParsingData.WithDetails("Error decoding clientData topOrigin as URL").WithError(err)
 			}
 
 			switch rpTopOriginsVerify {
diff --git a/protocol/credential.go b/protocol/credential.go
@@ -79,7 +79,7 @@ func ParseCredentialCreationResponseBody(body io.Reader) (pcc *ParsedCredentialC
 	var ccr CredentialCreationResponse
 
 	if err = decodeBody(body, &ccr); err != nil {
-		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo(err.Error())
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo(err.Error()).WithError(err)
 	}
 
 	return ccr.Parse()
@@ -91,7 +91,7 @@ func ParseCredentialCreationResponseBytes(data []byte) (pcc *ParsedCredentialCre
 	var ccr CredentialCreationResponse
 
 	if err = decodeBytes(data, &ccr); err != nil {
-		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo(err.Error())
+		return nil, ErrBadRequest.WithDetails("Parse error for Registration").WithInfo(err.Error()).WithError(err)
 	}
 
 	return ccr.Parse()
diff --git a/protocol/errors.go b/protocol/errors.go
diff --git a/protocol/metadata.go b/protocol/metadata.go
diff --git a/webauthn/login.go b/webauthn/login.go

Original file line number	Diff line number	Diff line change
`@@ -20,15 +20,15 @@ const (`
`20`	`20`	`)`
`21`	`21`
`22`	`22`	`var (`
`23`		`- errIntermediateCertRevoked = &MetadataError{`
	`23`	`+ errIntermediateCertRevoked = &Error{`
`24`	`24`	`Type: "intermediate_revoked",`
`25`	`25`	`Details: "Intermediate certificate is on issuers revocation list",`
`26`	`26`	`}`
`27`		`- errLeafCertRevoked = &MetadataError{`
	`27`	`+ errLeafCertRevoked = &Error{`
`28`	`28`	`Type: "leaf_revoked",`
`29`	`29`	`Details: "Leaf certificate is on issuers revocation list",`
`30`	`30`	`}`
`31`		`- errCRLUnavailable = &MetadataError{`
	`31`	`+ errCRLUnavailable = &Error{`
`32`	`32`	`Type: "crl_unavailable",`
`33`	`33`	`Details: "Certificate revocation list is unavailable",`
`34`	`34`	`}`
Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,7 @@ func TestConformanceMetadataTOCParsing(t *testing.T) {`
`82`	`82`	`var (`
`83`	`83`	`res *http.Response`
`84`	`84`	`blob *PayloadJSON`
`85`		`- me *MetadataError`
	`85`	`+ me *Error`
`86`	`86`	`)`
`87`	`87`
`88`	`88`	`for _, endpoint := range endpoints {`
Original file line number	Diff line number	Diff line change
`@@ -299,7 +299,7 @@ const (`
`299`	`299`	`ALG_KEY_COSE PublicKeyAlgAndEncoding = "cose"`
`300`	`300`	`)`
`301`	`301`
`302`		`-type MetadataError struct {`
	`302`	`+type Error struct {`
`303`	`303`	`// Short name for the type of error that has occurred.`
`304`	`304`	Type string `json:"type"`
`305`	`305`
`@@ -310,8 +310,8 @@ type MetadataError struct {`
`310`	`310`	DevInfo string `json:"debug"`
`311`	`311`	`}`
`312`	`312`
`313`		`-func (err *MetadataError) Error() string {`
`314`		`- return err.Details`
	`313`	`+func (e *Error) Error() string {`
	`314`	`+ return e.Details`
`315`	`315`	`}`
`316`	`316`
`317`	`317`	`// Clock is an interface used to implement clock functionality in various metadata areas.`
Original file line number	Diff line number	Diff line change
`@@ -69,7 +69,7 @@ func ParseCredentialRequestResponseBody(body io.Reader) (par *ParsedCredentialAs`
`69`	`69`	`var car CredentialAssertionResponse`
`70`	`70`
`71`	`71`	`if err = decodeBody(body, &car); err != nil {`
`72`		`- return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error())`
	`72`	`+ return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error()).WithError(err)`
`73`	`73`	`}`
`74`	`74`
`75`	`75`	`return car.Parse()`
`@@ -81,7 +81,7 @@ func ParseCredentialRequestResponseBytes(data []byte) (par *ParsedCredentialAsse`
`81`	`81`	`var car CredentialAssertionResponse`
`82`	`82`
`83`	`83`	`if err = decodeBytes(data, &car); err != nil {`
`84`		`- return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error())`
	`84`	`+ return nil, ErrBadRequest.WithDetails("Parse error for Assertion").WithInfo(err.Error()).WithError(err)`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`return car.Parse()`
`@@ -97,7 +97,7 @@ func (car CredentialAssertionResponse) Parse() (par *ParsedCredentialAssertionDa`
`97`	`97`	`}`
`98`	`98`
`99`	`99`	`if _, err = base64.RawURLEncoding.DecodeString(car.ID); err != nil {`
`100`		`- return nil, ErrBadRequest.WithDetails("CredentialAssertionResponse with ID not base64url encoded")`
	`100`	`+ return nil, ErrBadRequest.WithDetails("CredentialAssertionResponse with ID not base64url encoded").WithError(err)`
`101`	`101`	`}`
`102`	`102`
`103`	`103`	`if car.Type != string(PublicKeyCredentialType) {`
`@@ -129,7 +129,7 @@ func (car CredentialAssertionResponse) Parse() (par *ParsedCredentialAssertionDa`
`129`	`129`	`}`
`130`	`130`
`131`	`131`	`if err = par.Response.AuthenticatorData.Unmarshal(car.AssertionResponse.AuthenticatorData); err != nil {`
`132`		`- return nil, ErrParsingData.WithDetails("Error unmarshalling auth data")`
	`132`	`+ return nil, ErrParsingData.WithDetails("Error unmarshalling auth data").WithError(err)`
`133`	`133`	`}`
`134`	`134`
`135`	`135`	`return par, nil`
`@@ -189,12 +189,12 @@ func (p *ParsedCredentialAssertionData) Verify(storedChallenge string, relyingPa`
`189`	`189`	`}`
`190`	`190`
`191`	`191`	`if err != nil {`
`192`		`- return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error parsing the assertion public key: %+v", err))`
	`192`	`+ return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error parsing the assertion public key: %+v", err)).WithError(err)`
`193`	`193`	`}`
`194`	`194`
`195`	`195`	`valid, err := webauthncose.VerifySignature(key, sigData, p.Response.Signature)`
`196`	`196`	`if !valid \|\| err != nil {`
`197`		`- return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error validating the assertion signature: %+v", err))`
	`197`	`+ return ErrAssertionSignature.WithDetails(fmt.Sprintf("Error validating the assertion signature: %+v", err)).WithError(err)`
`198`	`198`	`}`
`199`	`199`
`200`	`200`	`return nil`
Original file line number	Diff line number	Diff line change
`@@ -94,18 +94,18 @@ func (ccr AuthenticatorAttestationResponse) Parse() (p ParsedAttestationRespon`
`94`	`94`	`p = &ParsedAttestationResponse{}`
`95`	`95`
`96`	`96`	`if err = json.Unmarshal(ccr.ClientDataJSON, &p.CollectedClientData); err != nil {`
`97`		`- return nil, ErrParsingData.WithInfo(err.Error())`
	`97`	`+ return nil, ErrParsingData.WithInfo(err.Error()).WithError(err)`
`98`	`98`	`}`
`99`	`99`
`100`	`100`	`if err = webauthncbor.Unmarshal(ccr.AttestationObject, &p.AttestationObject); err != nil {`
`101`		`- return nil, ErrParsingData.WithInfo(err.Error())`
	`101`	`+ return nil, ErrParsingData.WithInfo(err.Error()).WithError(err)`
`102`	`102`	`}`
`103`	`103`
`104`	`104`	`// Step 8. Perform CBOR decoding on the attestationObject field of the AuthenticatorAttestationResponse`
`105`	`105`	`// structure to obtain the attestation statement format fmt, the authenticator data authData, and`
`106`	`106`	`// the attestation statement attStmt.`
`107`	`107`	`if err = p.AttestationObject.AuthData.Unmarshal(p.AttestationObject.RawAuthData); err != nil {`
`108`		`- return nil, fmt.Errorf("error decoding auth data: %v", err)`
	`108`	`+ return nil, err`
`109`	`109`	`}`
`110`	`110`
`111`	`111`	`if !p.AttestationObject.AuthData.Flags.HasAttestedCredentialData() {`
`@@ -176,7 +176,7 @@ func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadat`
`176`	`176`
`177`	`177`	`if len(a.AuthData.AttData.AAGUID) != 0 {`
`178`	`178`	`if aaguid, err = uuid.FromBytes(a.AuthData.AttData.AAGUID); err != nil {`
`179`		`- return ErrInvalidAttestation.WithInfo("Error occurred parsing AAGUID during attestation validation").WithDetails(err.Error())`
	`179`	`+ return ErrInvalidAttestation.WithInfo("Error occurred parsing AAGUID during attestation validation").WithDetails(err.Error()).WithError(err)`
`180`	`180`	`}`
`181`	`181`	`}`
`182`	`182`
`@@ -187,7 +187,7 @@ func (a *AttestationObject) VerifyAttestation(clientDataHash []byte, mds metadat`
`187`	`187`	`var protoErr *Error`
`188`	`188`
`189`	`189`	`if protoErr = ValidateMetadata(context.Background(), mds, aaguid, attestationType, x5cs); protoErr != nil {`
`190`		`- return ErrInvalidAttestation.WithInfo(fmt.Sprintf("Error occurred validating metadata during attestation validation: %+v", protoErr)).WithDetails(protoErr.DevInfo)`
	`190`	`+ return ErrInvalidAttestation.WithInfo(fmt.Sprintf("Error occurred validating metadata during attestation validation: %+v", protoErr)).WithDetails(protoErr.DevInfo).WithError(protoErr)`
`191`	`191`	`}`
`192`	`192`
`193`	`193`	`return nil`
Original file line number	Diff line number	Diff line change
`@@ -65,25 +65,25 @@ func verifyAndroidKeyFormat(att AttestationObject, clientDataHash []byte, _ meta`
`65`	`65`
`66`	`66`	`attCert, err := x509.ParseCertificate(attCertBytes)`
`67`	`67`	`if err != nil {`
`68`		`- return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err))`
	`68`	`+ return "", nil, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)`
`69`	`69`	`}`
`70`	`70`
`71`	`71`	`coseAlg := webauthncose.COSEAlgorithmIdentifier(alg)`
`72`	`72`	`if err = attCert.CheckSignature(webauthncose.SigAlgFromCOSEAlg(coseAlg), signatureData, sig); err != nil {`
`73`		`- return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err))`
	`73`	`+ return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err)).WithError(err)`
`74`	`74`	`}`
`75`	`75`
`76`	`76`	`// Verify that the public key in the first certificate in x5c matches the credentialPublicKey in the attestedCredentialData in authenticatorData.`
`77`	`77`	`pubKey, err := webauthncose.ParsePublicKey(att.AuthData.AttData.CredentialPublicKey)`
`78`	`78`	`if err != nil {`
`79`		`- return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err))`
	`79`	`+ return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err)).WithError(err)`
`80`	`80`	`}`
`81`	`81`
`82`	`82`	`e := pubKey.(webauthncose.EC2PublicKeyData)`
`83`	`83`
`84`	`84`	`valid, err = e.Verify(signatureData, sig)`
`85`	`85`	`if err != nil \|\| !valid {`
`86`		`- return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err))`
	`86`	`+ return "", nil, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Error parsing public key: %+v\n", err)).WithError(err)`
`87`	`87`	`}`
`88`	`88`
`89`	`89`	`// §8.4.3. Verify that the attestationChallenge field in the attestation certificate extension data is identical to clientDataHash.`
`@@ -105,11 +105,11 @@ func verifyAndroidKeyFormat(att AttestationObject, clientDataHash []byte, _ meta`
`105`	`105`	`decoded := keyDescription{}`
`106`	`106`
`107`	`107`	`if _, err = asn1.Unmarshal(attExtBytes, &decoded); err != nil {`
`108`		`- return "", nil, ErrAttestationFormat.WithDetails("Unable to parse Android key attestation certificate extensions")`
	`108`	`+ return "", nil, ErrAttestationFormat.WithDetails("Unable to parse Android key attestation certificate extensions").WithError(err)`
`109`	`109`	`}`
`110`	`110`
`111`	`111`	`// Verify that the attestationChallenge field in the attestation certificate extension data is identical to clientDataHash.`
`112`		`- if 0 != bytes.Compare(decoded.AttestationChallenge, clientDataHash) {`
	`112`	`+ if bytes.Compare(decoded.AttestationChallenge, clientDataHash) != 0 {`
`113`	`113`	`return "", nil, ErrAttestationFormat.WithDetails("Attestation challenge not equal to clientDataHash")`
`114`	`114`	`}`
`115`	`115`
Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ func handleBasicAttestation(signature, clientDataHash, authData, aaguid []byte,`
`81`	`81`
`82`	`82`	`ct, err := x509.ParseCertificate(cb)`
`83`	`83`	`if err != nil {`
`84`		`- return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err))`
	`84`	`+ return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`if ct.NotBefore.After(time.Now()) \|\| ct.NotAfter.Before(time.Now()) {`
`@@ -98,12 +98,12 @@ func handleBasicAttestation(signature, clientDataHash, authData, aaguid []byte,`
`98`	`98`
`99`	`99`	`attCert, err := x509.ParseCertificate(attCertBytes)`
`100`	`100`	`if err != nil {`
`101`		`- return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err))`
	`101`	`+ return "", x5c, ErrAttestationFormat.WithDetails(fmt.Sprintf("Error parsing certificate from ASN.1 data: %+v", err)).WithError(err)`
`102`	`102`	`}`
`103`	`103`
`104`	`104`	`coseAlg := webauthncose.COSEAlgorithmIdentifier(alg)`
`105`	`105`	`if err = attCert.CheckSignature(webauthncose.SigAlgFromCOSEAlg(coseAlg), signatureData, signature); err != nil {`
`106`		`- return "", x5c, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err))`
	`106`	`+ return "", x5c, ErrInvalidAttestation.WithDetails(fmt.Sprintf("Signature validation error: %+v\n", err)).WithError(err)`
`107`	`107`	`}`
`108`	`108`
`109`	`109`	`// Step 2.2 Verify that attestnCert meets the requirements in §8.2.1 Packed attestation statement certificate requirements.`