refactor(tee-verifier): return Result via #[handle_result], move error out of the wire crate

verify_quote now returns Result<VerifiedReport, VerifierError> with
#[handle_result] instead of returning a bare value and calling env::panic_str
directly. Behaviour is unchanged (an Err still panics, surfacing to a
cross-contract caller as PromiseError::Failed), but the fallible-method shape
matches the rest of the contract surface and the error message now comes from
the error's Display.

VerifierError moves from tee-verifier-interface into tee-verifier: it never
crosses the wire (failures panic rather than serialize a returned error), so it
does not belong in the DTO crate. tee-verifier-interface drops its thiserror
dependency and keeps only the genuine wire types; tee-verifier picks thiserror
up and implements FunctionError on the local error.

Author: pbeza

Cargo.lock

@@ -10,7 +10,6 @@ borsh-schema = ["borsh/unstable__schema"]
 
 [dependencies]
 borsh = { workspace = true }
-thiserror = { workspace = true }
 
 [dev-dependencies]
 rstest = { workspace = true }

crates/tee-verifier-interface/Cargo.toml

@@ -62,19 +62,6 @@ pub struct Collateral {
     pub pck_certificate_chain: Option<String>,
 }
 
-/// Errors returned by `tee-verifier`'s `verify_quote` method.
-///
-/// Borsh-stable. Mirrors what `dcap_qvl::verify::verify` would otherwise
-/// surface to the caller, plus room for verifier-side failures.
-#[derive(Debug, Clone, BorshSerialize, BorshDeserialize, thiserror::Error)]
-#[cfg_attr(feature = "borsh-schema", derive(borsh::BorshSchema))]
-pub enum VerifierError {
-    /// `dcap_qvl::verify::verify` rejected the quote / collateral. The string
-    /// is the upstream error rendered with `Display`.
-    #[error("dcap verification failed: {0}")]
-    DcapVerification(String),
-}
-
 /// Verified TDX / SGX quote, mirroring `dcap_qvl::verify::VerifiedReport`.
 ///
 /// All fields match the upstream type one-to-one. Borsh-stable.
@@ -257,22 +244,6 @@ mod tests {
         assert_eq!(original, decoded);
     }
 
-    #[test]
-    fn verifier_error__should_round_trip_borsh() {
-        // Given
-        let original = VerifierError::DcapVerification(String::from("bad signature"));
-
-        // When
-        let bytes = borsh::to_vec(&original).expect("Borsh serialization should succeed");
-        let decoded: VerifierError =
-            borsh::from_slice(&bytes).expect("Borsh deserialization should succeed");
-
-        // Then
-        match decoded {
-            VerifierError::DcapVerification(msg) => assert_eq!(msg, "bad signature"),
-        }
-    }
-
     #[test]
     fn report__as_td10__should_unwrap_td15_to_its_base() {
         // Given

crates/tee-verifier-interface/src/lib.rs

@@ -39,6 +39,7 @@ borsh = { workspace = true }
 dcap-qvl = { workspace = true }
 near-sdk = { workspace = true }
 tee-verifier-interface = { workspace = true }
+thiserror = { workspace = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 getrandom = { workspace = true, features = ["custom"] }

crates/tee-verifier/Cargo.toml

@@ -8,11 +8,25 @@
 //!
 //! See `docs/design/attestation-verifier-contract.md` for the design.
 
-use near_sdk::{env, near};
+use near_sdk::{FunctionError, env, near};
 use tee_verifier_interface::{Collateral, QuoteBytes, VerifiedReport};
 
 mod conversions;
 
+/// Failure returned by [`TeeVerifier::verify_quote`].
+#[derive(Debug, Clone, thiserror::Error)]
+pub enum VerifierError {
+    /// `dcap_qvl::verify::verify` rejected the quote / collateral.
+    #[error("dcap verification failed: {0}")]
+    DcapVerification(String),
+}
+
+impl FunctionError for VerifierError {
+    fn panic(&self) -> ! {
+        env::panic_str(&self.to_string())
+    }
+}
+
 // `dcap-qvl`'s `contract` feature pulls in `getrandom` but doesn't enable
 // any backend. On `wasm32-unknown-unknown` we register a custom impl that
 // returns `UNSUPPORTED`. Quote verification should not draw any randomness;
@@ -30,30 +44,24 @@ pub struct TeeVerifier {}
 
 #[near]
 impl TeeVerifier {
-    /// Verify a TDX / SGX quote against Intel collateral.
+    /// Verify a TDX quote against Intel collateral.
     ///
     /// Calls `dcap_qvl::verify::verify` with the current block timestamp
     /// and returns the parsed `VerifiedReport` on success. The caller is
     /// responsible for any post-DCAP policy (RTMR3 replay, report-data
     /// binding, measurement allowlist matching, etc.).
-    ///
-    /// On verification failure, panics with the upstream error rendered as
-    /// a string. Callers should treat this as a `PromiseResult::Failed` in
-    /// their callback.
-    ///
-    /// Borsh I/O on both arguments and return value.
+    #[handle_result]
     #[result_serializer(borsh)]
     pub fn verify_quote(
         &self,
         #[serializer(borsh)] quote: QuoteBytes,
         #[serializer(borsh)] collateral: Collateral,
-    ) -> VerifiedReport {
+    ) -> Result<VerifiedReport, VerifierError> {
         let now_seconds = env::block_timestamp_ms() / 1000;
         let quote_bytes = conversions::quote_bytes_to_vec(quote);
         let collateral = conversions::collateral_to_dcap(collateral);
-        match dcap_qvl::verify::verify(&quote_bytes, &collateral, now_seconds) {
-            Ok(report) => conversions::verified_report(report),
-            Err(err) => env::panic_str(&format!("dcap verification failed: {err:?}")),
-        }
+        dcap_qvl::verify::verify(&quote_bytes, &collateral, now_seconds)
+            .map(conversions::verified_report)
+            .map_err(|err| VerifierError::DcapVerification(format!("{err:?}")))
     }
 }

crates/tee-verifier/src/lib.rs

@@ -55,7 +55,9 @@ fn verify_quote__should_return_up_to_date_td10_report_for_valid_fixture() {
     let collateral = make_collateral();
 
     // When
-    let report = contract.verify_quote(quote, collateral);
+    let report = contract
+        .verify_quote(quote, collateral)
+        .expect("valid fixture should verify");
 
     // Then
     assert_eq!(report.status, "UpToDate");