@greysemanticist It works, because thiserror generates a From impl for rusqlite::Error for your AuthError (due to the #[from] attribute).
And ? will use that From impl to return AuthError.
See also the std #Rust docs on how ? works:
"When applied to values of the Result<T, E> type, it propagates errors. If the value is Err(e), then it will return Err(From::from(e)) from the enclosing function or closure."
https://doc.rust-lang.org/reference/expressions/operator-expr.html#the-question-mark-operator
#thiserror and ? can look like magic, but it's just #RustLang