From 7b36571788d99f92514a7d0f26098e89d08694db Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Sun, 16 Aug 2020 00:42:36 -0400 Subject: [PATCH] Change auth validity feedback (#273) * Change auth validity feedback Move from a bool indicating validity to lack of an error. This allows the error to be directly returned and typed. * Fix erroneous line --- internal/auth/auth.go | 11 +++-- .../handlers/accounts/account_service.go | 20 ++++----- .../authenticate/authenticate_service.go | 4 +- .../authmethods/authmethod_service.go | 20 ++++----- .../handlers/authtokens/authtoken_service.go | 12 ++--- .../handlers/groups/group_service.go | 32 +++++++------- .../host_catalogs/host_catalog_service.go | 16 +++---- .../controller/handlers/roles/role_service.go | 44 +++++++++---------- .../handlers/scopes/scope_service.go | 20 ++++----- .../controller/handlers/users/user_service.go | 20 ++++----- 10 files changed, 101 insertions(+), 98 deletions(-) diff --git a/internal/auth/auth.go b/internal/auth/auth.go index 180534a83..813904040 100644 --- a/internal/auth/auth.go +++ b/internal/auth/auth.go @@ -10,6 +10,7 @@ import ( "github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes" "github.com/hashicorp/boundary/internal/perms" "github.com/hashicorp/boundary/internal/servers/controller/common" + "github.com/hashicorp/boundary/internal/servers/controller/handlers" "github.com/hashicorp/boundary/internal/types/action" "github.com/hashicorp/boundary/internal/types/resource" "github.com/hashicorp/boundary/internal/types/scope" @@ -53,8 +54,8 @@ type RequestInfo struct { } type VerifyResults struct { - Valid bool UserId string + Error error Scope *scopes.ScopeInfo } @@ -91,6 +92,7 @@ func NewVerifierContext(ctx context.Context, // proceed, e.g. whether the authn/authz check resulted in failure. If an error // occurs it's logged to the system log. func Verify(ctx context.Context, opt ...Option) (ret VerifyResults) { + ret.Error = handlers.ForbiddenError() v, ok := ctx.Value(verifierKey).(*verifier) if !ok { // We don't have a logger yet and this should never happen in any @@ -110,7 +112,7 @@ func Verify(ctx context.Context, opt ...Option) (ret VerifyResults) { ret.Scope.Type = scope.Project.String() } ret.UserId = v.requestInfo.userIdOverride - ret.Valid = true + ret.Error = nil return } v.ctx = ctx @@ -132,15 +134,16 @@ func Verify(ctx context.Context, opt ...Option) (ret VerifyResults) { return } if !authResults.Allowed { - // TODO: Decide whether to remove this if v.requestInfo.DisableAuthzFailures { + ret.Error = nil + // TODO: Decide whether to remove this v.logger.Info("failed authz info for request", "resource", pretty.Sprint(v.res), "user_id", ret.UserId, "action", v.act.String()) } else { return } } - ret.Valid = true + ret.Error = nil return } diff --git a/internal/servers/controller/handlers/accounts/account_service.go b/internal/servers/controller/handlers/accounts/account_service.go index ad767bc4b..fc5e8ac88 100644 --- a/internal/servers/controller/handlers/accounts/account_service.go +++ b/internal/servers/controller/handlers/accounts/account_service.go @@ -51,8 +51,8 @@ var _ pbs.AccountServiceServer = Service{} // ListAccounts implements the interface pbs.AccountServiceServer. func (s Service) ListAccounts(ctx context.Context, req *pbs.ListAccountsRequest) (*pbs.ListAccountsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateListRequest(req); err != nil { return nil, err @@ -70,8 +70,8 @@ func (s Service) ListAccounts(ctx context.Context, req *pbs.ListAccountsRequest) // GetAccounts implements the interface pbs.AccountServiceServer. func (s Service) GetAccount(ctx context.Context, req *pbs.GetAccountRequest) (*pbs.GetAccountResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateGetRequest(req); err != nil { return nil, err @@ -87,8 +87,8 @@ func (s Service) GetAccount(ctx context.Context, req *pbs.GetAccountRequest) (*p // CreateAccount implements the interface pbs.AccountServiceServer. func (s Service) CreateAccount(ctx context.Context, req *pbs.CreateAccountRequest) (*pbs.CreateAccountResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateCreateRequest(req); err != nil { return nil, err @@ -104,8 +104,8 @@ func (s Service) CreateAccount(ctx context.Context, req *pbs.CreateAccountReques // UpdateAccount implements the interface pbs.AccountServiceServer. func (s Service) UpdateAccount(ctx context.Context, req *pbs.UpdateAccountRequest) (*pbs.UpdateAccountResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateUpdateRequest(req); err != nil { return nil, err @@ -121,8 +121,8 @@ func (s Service) UpdateAccount(ctx context.Context, req *pbs.UpdateAccountReques // DeleteAccount implements the interface pbs.AccountServiceServer. func (s Service) DeleteAccount(ctx context.Context, req *pbs.DeleteAccountRequest) (*pbs.DeleteAccountResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateDeleteRequest(req); err != nil { return nil, err diff --git a/internal/servers/controller/handlers/authenticate/authenticate_service.go b/internal/servers/controller/handlers/authenticate/authenticate_service.go index b559d7211..8af2d86ca 100644 --- a/internal/servers/controller/handlers/authenticate/authenticate_service.go +++ b/internal/servers/controller/handlers/authenticate/authenticate_service.go @@ -54,8 +54,8 @@ var _ pbs.AuthenticationServiceServer = Service{} // Authenticate implements the interface pbs.AuthenticationServiceServer. func (s Service) Authenticate(ctx context.Context, req *pbs.AuthenticateRequest) (*pbs.AuthenticateResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateAuthenticateRequest(req); err != nil { return nil, err diff --git a/internal/servers/controller/handlers/authmethods/authmethod_service.go b/internal/servers/controller/handlers/authmethods/authmethod_service.go index 54ac05f1a..bdb0aef85 100644 --- a/internal/servers/controller/handlers/authmethods/authmethod_service.go +++ b/internal/servers/controller/handlers/authmethods/authmethod_service.go @@ -49,8 +49,8 @@ var _ pbs.AuthMethodServiceServer = Service{} // ListAuthMethods implements the interface pbs.AuthMethodServiceServer. func (s Service) ListAuthMethods(ctx context.Context, req *pbs.ListAuthMethodsRequest) (*pbs.ListAuthMethodsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateListRequest(req); err != nil { return nil, err @@ -68,8 +68,8 @@ func (s Service) ListAuthMethods(ctx context.Context, req *pbs.ListAuthMethodsRe // GetAuthMethods implements the interface pbs.AuthMethodServiceServer. func (s Service) GetAuthMethod(ctx context.Context, req *pbs.GetAuthMethodRequest) (*pbs.GetAuthMethodResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateGetRequest(req); err != nil { return nil, err @@ -85,8 +85,8 @@ func (s Service) GetAuthMethod(ctx context.Context, req *pbs.GetAuthMethodReques // CreateAuthMethod implements the interface pbs.AuthMethodServiceServer. func (s Service) CreateAuthMethod(ctx context.Context, req *pbs.CreateAuthMethodRequest) (*pbs.CreateAuthMethodResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateCreateRequest(req); err != nil { return nil, err @@ -102,8 +102,8 @@ func (s Service) CreateAuthMethod(ctx context.Context, req *pbs.CreateAuthMethod // UpdateAuthMethod implements the interface pbs.AuthMethodServiceServer. func (s Service) UpdateAuthMethod(ctx context.Context, req *pbs.UpdateAuthMethodRequest) (*pbs.UpdateAuthMethodResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateUpdateRequest(req); err != nil { return nil, err @@ -119,8 +119,8 @@ func (s Service) UpdateAuthMethod(ctx context.Context, req *pbs.UpdateAuthMethod // DeleteAuthMethod implements the interface pbs.AuthMethodServiceServer. func (s Service) DeleteAuthMethod(ctx context.Context, req *pbs.DeleteAuthMethodRequest) (*pbs.DeleteAuthMethodResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateDeleteRequest(req); err != nil { return nil, err diff --git a/internal/servers/controller/handlers/authtokens/authtoken_service.go b/internal/servers/controller/handlers/authtokens/authtoken_service.go index 03242ed91..6cfc7e79d 100644 --- a/internal/servers/controller/handlers/authtokens/authtoken_service.go +++ b/internal/servers/controller/handlers/authtokens/authtoken_service.go @@ -41,8 +41,8 @@ var _ pbs.AuthTokenServiceServer = Service{} // ListAuthTokens implements the interface pbs.AuthTokenServiceServer. func (s Service) ListAuthTokens(ctx context.Context, req *pbs.ListAuthTokensRequest) (*pbs.ListAuthTokensResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateListRequest(req); err != nil { return nil, err @@ -60,8 +60,8 @@ func (s Service) ListAuthTokens(ctx context.Context, req *pbs.ListAuthTokensRequ // GetAuthTokens implements the interface pbs.AuthTokenServiceServer. func (s Service) GetAuthToken(ctx context.Context, req *pbs.GetAuthTokenRequest) (*pbs.GetAuthTokenResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateGetRequest(req); err != nil { return nil, err @@ -77,8 +77,8 @@ func (s Service) GetAuthToken(ctx context.Context, req *pbs.GetAuthTokenRequest) // DeleteAuthToken implements the interface pbs.AuthTokenServiceServer. func (s Service) DeleteAuthToken(ctx context.Context, req *pbs.DeleteAuthTokenRequest) (*pbs.DeleteAuthTokenResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateDeleteRequest(req); err != nil { return nil, err diff --git a/internal/servers/controller/handlers/groups/group_service.go b/internal/servers/controller/handlers/groups/group_service.go index 75acd0f4a..7d07ff670 100644 --- a/internal/servers/controller/handlers/groups/group_service.go +++ b/internal/servers/controller/handlers/groups/group_service.go @@ -49,8 +49,8 @@ var _ pbs.GroupServiceServer = Service{} // ListGroups implements the interface pbs.GroupServiceServer. func (s Service) ListGroups(ctx context.Context, req *pbs.ListGroupsRequest) (*pbs.ListGroupsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateListRequest(req); err != nil { return nil, err @@ -68,8 +68,8 @@ func (s Service) ListGroups(ctx context.Context, req *pbs.ListGroupsRequest) (*p // GetGroups implements the interface pbs.GroupServiceServer. func (s Service) GetGroup(ctx context.Context, req *pbs.GetGroupRequest) (*pbs.GetGroupResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateGetRequest(req); err != nil { return nil, err @@ -85,8 +85,8 @@ func (s Service) GetGroup(ctx context.Context, req *pbs.GetGroupRequest) (*pbs.G // CreateGroup implements the interface pbs.GroupServiceServer. func (s Service) CreateGroup(ctx context.Context, req *pbs.CreateGroupRequest) (*pbs.CreateGroupResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateCreateRequest(req); err != nil { return nil, err @@ -102,8 +102,8 @@ func (s Service) CreateGroup(ctx context.Context, req *pbs.CreateGroupRequest) ( // UpdateGroup implements the interface pbs.GroupServiceServer. func (s Service) UpdateGroup(ctx context.Context, req *pbs.UpdateGroupRequest) (*pbs.UpdateGroupResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateUpdateRequest(req); err != nil { return nil, err @@ -119,8 +119,8 @@ func (s Service) UpdateGroup(ctx context.Context, req *pbs.UpdateGroupRequest) ( // DeleteGroup implements the interface pbs.GroupServiceServer. func (s Service) DeleteGroup(ctx context.Context, req *pbs.DeleteGroupRequest) (*pbs.DeleteGroupResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateDeleteRequest(req); err != nil { return nil, err @@ -135,8 +135,8 @@ func (s Service) DeleteGroup(ctx context.Context, req *pbs.DeleteGroupRequest) ( // AddGroupMembers implements the interface pbs.GroupServiceServer. func (s Service) AddGroupMembers(ctx context.Context, req *pbs.AddGroupMembersRequest) (*pbs.AddGroupMembersResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateAddGroupMembersRequest(req); err != nil { return nil, err @@ -151,8 +151,8 @@ func (s Service) AddGroupMembers(ctx context.Context, req *pbs.AddGroupMembersRe // SetGroupMembers implements the interface pbs.GroupServiceServer. func (s Service) SetGroupMembers(ctx context.Context, req *pbs.SetGroupMembersRequest) (*pbs.SetGroupMembersResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateSetGroupMembersRequest(req); err != nil { return nil, err @@ -167,8 +167,8 @@ func (s Service) SetGroupMembers(ctx context.Context, req *pbs.SetGroupMembersRe // RemoveGroupMembers implements the interface pbs.GroupServiceServer. func (s Service) RemoveGroupMembers(ctx context.Context, req *pbs.RemoveGroupMembersRequest) (*pbs.RemoveGroupMembersResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateRemoveGroupMembersRequest(req); err != nil { return nil, err diff --git a/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go b/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go index d789751ff..f31f42e95 100644 --- a/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go +++ b/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go @@ -91,8 +91,8 @@ func (s Service) ListHostCatalogs(ctx context.Context, req *pbs.ListHostCatalogs // GetHostCatalog implements the interface pbs.HostCatalogServiceServer. func (s Service) GetHostCatalog(ctx context.Context, req *pbs.GetHostCatalogRequest) (*pbs.GetHostCatalogResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } ct := typeFromId(req.GetId()) if ct == unknownType { @@ -112,8 +112,8 @@ func (s Service) GetHostCatalog(ctx context.Context, req *pbs.GetHostCatalogRequ // CreateHostCatalog implements the interface pbs.HostCatalogServiceServer. func (s Service) CreateHostCatalog(ctx context.Context, req *pbs.CreateHostCatalogRequest) (*pbs.CreateHostCatalogResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateCreateRequest(req); err != nil { return nil, err @@ -132,8 +132,8 @@ func (s Service) CreateHostCatalog(ctx context.Context, req *pbs.CreateHostCatal // UpdateHostCatalog implements the interface pbs.HostCatalogServiceServer. func (s Service) UpdateHostCatalog(ctx context.Context, req *pbs.UpdateHostCatalogRequest) (*pbs.UpdateHostCatalogResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } ct := typeFromId(req.GetId()) if ct == unknownType { @@ -153,8 +153,8 @@ func (s Service) UpdateHostCatalog(ctx context.Context, req *pbs.UpdateHostCatal // DeleteHostCatalog implements the interface pbs.HostCatalogServiceServer. func (s Service) DeleteHostCatalog(ctx context.Context, req *pbs.DeleteHostCatalogRequest) (*pbs.DeleteHostCatalogResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } ct := typeFromId(req.GetId()) if ct == unknownType { diff --git a/internal/servers/controller/handlers/roles/role_service.go b/internal/servers/controller/handlers/roles/role_service.go index 68acd807f..dccd2e274 100644 --- a/internal/servers/controller/handlers/roles/role_service.go +++ b/internal/servers/controller/handlers/roles/role_service.go @@ -51,8 +51,8 @@ var _ pbs.RoleServiceServer = Service{} // ListRoles implements the interface pbs.RoleServiceServer. func (s Service) ListRoles(ctx context.Context, req *pbs.ListRolesRequest) (*pbs.ListRolesResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateListRequest(req); err != nil { return nil, err @@ -70,8 +70,8 @@ func (s Service) ListRoles(ctx context.Context, req *pbs.ListRolesRequest) (*pbs // GetRoles implements the interface pbs.RoleServiceServer. func (s Service) GetRole(ctx context.Context, req *pbs.GetRoleRequest) (*pbs.GetRoleResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateGetRequest(req); err != nil { return nil, err @@ -87,8 +87,8 @@ func (s Service) GetRole(ctx context.Context, req *pbs.GetRoleRequest) (*pbs.Get // CreateRole implements the interface pbs.RoleServiceServer. func (s Service) CreateRole(ctx context.Context, req *pbs.CreateRoleRequest) (*pbs.CreateRoleResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateCreateRequest(req, authResults.Scope); err != nil { return nil, err @@ -104,8 +104,8 @@ func (s Service) CreateRole(ctx context.Context, req *pbs.CreateRoleRequest) (*p // UpdateRole implements the interface pbs.RoleServiceServer. func (s Service) UpdateRole(ctx context.Context, req *pbs.UpdateRoleRequest) (*pbs.UpdateRoleResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateUpdateRequest(req, authResults.Scope); err != nil { return nil, err @@ -121,8 +121,8 @@ func (s Service) UpdateRole(ctx context.Context, req *pbs.UpdateRoleRequest) (*p // DeleteRole implements the interface pbs.RoleServiceServer. func (s Service) DeleteRole(ctx context.Context, req *pbs.DeleteRoleRequest) (*pbs.DeleteRoleResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateDeleteRequest(req); err != nil { return nil, err @@ -137,8 +137,8 @@ func (s Service) DeleteRole(ctx context.Context, req *pbs.DeleteRoleRequest) (*p // AddRolePrincipals implements the interface pbs.RoleServiceServer. func (s Service) AddRolePrincipals(ctx context.Context, req *pbs.AddRolePrincipalsRequest) (*pbs.AddRolePrincipalsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateAddRolePrincipalsRequest(req); err != nil { return nil, err @@ -154,8 +154,8 @@ func (s Service) AddRolePrincipals(ctx context.Context, req *pbs.AddRolePrincipa // SetRolePrincipals implements the interface pbs.RoleServiceServer. func (s Service) SetRolePrincipals(ctx context.Context, req *pbs.SetRolePrincipalsRequest) (*pbs.SetRolePrincipalsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateSetRolePrincipalsRequest(req); err != nil { return nil, err @@ -171,8 +171,8 @@ func (s Service) SetRolePrincipals(ctx context.Context, req *pbs.SetRolePrincipa // RemoveRolePrincipals implements the interface pbs.RoleServiceServer. func (s Service) RemoveRolePrincipals(ctx context.Context, req *pbs.RemoveRolePrincipalsRequest) (*pbs.RemoveRolePrincipalsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateRemoveRolePrincipalsRequest(req); err != nil { return nil, err @@ -188,8 +188,8 @@ func (s Service) RemoveRolePrincipals(ctx context.Context, req *pbs.RemoveRolePr // AddRoleGrants implements the interface pbs.RoleServiceServer. func (s Service) AddRoleGrants(ctx context.Context, req *pbs.AddRoleGrantsRequest) (*pbs.AddRoleGrantsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateAddRoleGrantsRequest(req); err != nil { return nil, err @@ -205,8 +205,8 @@ func (s Service) AddRoleGrants(ctx context.Context, req *pbs.AddRoleGrantsReques // SetRoleGrants implements the interface pbs.RoleServiceServer. func (s Service) SetRoleGrants(ctx context.Context, req *pbs.SetRoleGrantsRequest) (*pbs.SetRoleGrantsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateSetRoleGrantsRequest(req); err != nil { return nil, err @@ -222,8 +222,8 @@ func (s Service) SetRoleGrants(ctx context.Context, req *pbs.SetRoleGrantsReques // RemoveRoleGrants implements the interface pbs.RoleServiceServer. func (s Service) RemoveRoleGrants(ctx context.Context, req *pbs.RemoveRoleGrantsRequest) (*pbs.RemoveRoleGrantsResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateRemoveRoleGrantsRequest(req); err != nil { return nil, err diff --git a/internal/servers/controller/handlers/scopes/scope_service.go b/internal/servers/controller/handlers/scopes/scope_service.go index ff8f3a668..e7b68775f 100644 --- a/internal/servers/controller/handlers/scopes/scope_service.go +++ b/internal/servers/controller/handlers/scopes/scope_service.go @@ -54,8 +54,8 @@ func (s Service) ListScopes(ctx context.Context, req *pbs.ListScopesRequest) (*p req.ScopeId = scope.Global.String() } authResults := auth.Verify(ctx, auth.WithScopeId(req.GetScopeId())) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateListRequest(req); err != nil { @@ -76,8 +76,8 @@ func (s Service) ListScopes(ctx context.Context, req *pbs.ListScopesRequest) (*p // GetScopes implements the interface pbs.ScopeServiceServer. func (s Service) GetScope(ctx context.Context, req *pbs.GetScopeRequest) (*pbs.GetScopeResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateGetRequest(req); err != nil { return nil, err @@ -99,8 +99,8 @@ func (s Service) CreateScope(ctx context.Context, req *pbs.CreateScopeRequest) ( ) } authResults := auth.Verify(ctx, auth.WithScopeId(req.GetScopeId())) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateCreateRequest(req); err != nil { @@ -117,8 +117,8 @@ func (s Service) CreateScope(ctx context.Context, req *pbs.CreateScopeRequest) ( // UpdateScope implements the interface pbs.ScopeServiceServer. func (s Service) UpdateScope(ctx context.Context, req *pbs.UpdateScopeRequest) (*pbs.UpdateScopeResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateUpdateRequest(req); err != nil { return nil, err @@ -134,8 +134,8 @@ func (s Service) UpdateScope(ctx context.Context, req *pbs.UpdateScopeRequest) ( // DeleteScope implements the interface pbs.ScopeServiceServer. func (s Service) DeleteScope(ctx context.Context, req *pbs.DeleteScopeRequest) (*pbs.DeleteScopeResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateDeleteRequest(req); err != nil { return nil, err diff --git a/internal/servers/controller/handlers/users/user_service.go b/internal/servers/controller/handlers/users/user_service.go index ed8d90e22..eae2b70ca 100644 --- a/internal/servers/controller/handlers/users/user_service.go +++ b/internal/servers/controller/handlers/users/user_service.go @@ -49,8 +49,8 @@ var _ pbs.UserServiceServer = Service{} // ListUsers implements the interface pbs.UserServiceServer. func (s Service) ListUsers(ctx context.Context, req *pbs.ListUsersRequest) (*pbs.ListUsersResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateListRequest(req); err != nil { return nil, err @@ -68,8 +68,8 @@ func (s Service) ListUsers(ctx context.Context, req *pbs.ListUsersRequest) (*pbs // GetUsers implements the interface pbs.UserServiceServer. func (s Service) GetUser(ctx context.Context, req *pbs.GetUserRequest) (*pbs.GetUserResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateGetRequest(req); err != nil { return nil, err @@ -85,8 +85,8 @@ func (s Service) GetUser(ctx context.Context, req *pbs.GetUserRequest) (*pbs.Get // CreateUser implements the interface pbs.UserServiceServer. func (s Service) CreateUser(ctx context.Context, req *pbs.CreateUserRequest) (*pbs.CreateUserResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateCreateRequest(req); err != nil { return nil, err @@ -102,8 +102,8 @@ func (s Service) CreateUser(ctx context.Context, req *pbs.CreateUserRequest) (*p // UpdateUser implements the interface pbs.UserServiceServer. func (s Service) UpdateUser(ctx context.Context, req *pbs.UpdateUserRequest) (*pbs.UpdateUserResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateUpdateRequest(req); err != nil { return nil, err @@ -119,8 +119,8 @@ func (s Service) UpdateUser(ctx context.Context, req *pbs.UpdateUserRequest) (*p // DeleteUser implements the interface pbs.UserServiceServer. func (s Service) DeleteUser(ctx context.Context, req *pbs.DeleteUserRequest) (*pbs.DeleteUserResponse, error) { authResults := auth.Verify(ctx) - if !authResults.Valid { - return nil, handlers.ForbiddenError() + if authResults.Error != nil { + return nil, authResults.Error } if err := validateDeleteRequest(req); err != nil { return nil, err