diff --git a/backend/e2e-test/routes/v2/service-token.spec.ts b/backend/e2e-test/routes/v2/service-token.spec.ts index 6cc8f6e34..a07eda4b9 100644 --- a/backend/e2e-test/routes/v2/service-token.spec.ts +++ b/backend/e2e-test/routes/v2/service-token.spec.ts @@ -510,7 +510,7 @@ describe("Service token fail cases", async () => { authorization: `Bearer ${serviceToken}` } }); - expect(fetchSecrets.statusCode).toBe(403); + expect(fetchSecrets.statusCode).toBe(401); expect(fetchSecrets.json().error).toBe("PermissionDenied"); await deleteServiceToken(); }); @@ -532,7 +532,7 @@ describe("Service token fail cases", async () => { authorization: `Bearer ${serviceToken}` } }); - expect(fetchSecrets.statusCode).toBe(403); + expect(fetchSecrets.statusCode).toBe(401); expect(fetchSecrets.json().error).toBe("PermissionDenied"); await deleteServiceToken(); }); @@ -557,7 +557,7 @@ describe("Service token fail cases", async () => { authorization: `Bearer ${serviceToken}` } }); - expect(writeSecrets.statusCode).toBe(403); + expect(writeSecrets.statusCode).toBe(401); expect(writeSecrets.json().error).toBe("PermissionDenied"); // but read access should still work fine diff --git a/backend/e2e-test/routes/v3/secrets.spec.ts b/backend/e2e-test/routes/v3/secrets.spec.ts index c035692ed..e7e271279 100644 --- a/backend/e2e-test/routes/v3/secrets.spec.ts +++ b/backend/e2e-test/routes/v3/secrets.spec.ts @@ -1075,7 +1075,7 @@ describe("Secret V3 Raw Router Without E2EE enabled", async () => { }, body: createSecretReqBody }); - expect(createSecRes.statusCode).toBe(404); + expect(createSecRes.statusCode).toBe(400); }); test("Update secret raw", async () => { @@ -1093,7 +1093,7 @@ describe("Secret V3 Raw Router Without E2EE enabled", async () => { }, body: updateSecretReqBody }); - expect(updateSecRes.statusCode).toBe(404); + expect(updateSecRes.statusCode).toBe(400); }); test("Delete secret raw", async () => { @@ -1110,6 +1110,6 @@ describe("Secret V3 Raw Router Without E2EE enabled", async () => { }, body: deletedSecretReqBody }); - expect(deletedSecRes.statusCode).toBe(404); + expect(deletedSecRes.statusCode).toBe(400); }); }); diff --git a/backend/src/ee/routes/v1/identity-project-additional-privilege-router.ts b/backend/src/ee/routes/v1/identity-project-additional-privilege-router.ts index 2e7fd60d3..58c6793d7 100644 --- a/backend/src/ee/routes/v1/identity-project-additional-privilege-router.ts +++ b/backend/src/ee/routes/v1/identity-project-additional-privilege-router.ts @@ -5,7 +5,7 @@ import { z } from "zod"; import { IdentityProjectAdditionalPrivilegeTemporaryMode } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-types"; import { IDENTITY_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs"; -import { UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; @@ -61,7 +61,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F handler: async (req) => { const { permissions, privilegePermission } = req.body; if (!permissions && !privilegePermission) { - throw new UnauthorizedError({ message: "Permission or privilegePermission must be provided" }); + throw new BadRequestError({ message: "Permission or privilegePermission must be provided" }); } const permission = privilegePermission @@ -140,7 +140,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F handler: async (req) => { const { permissions, privilegePermission } = req.body; if (!permissions && !privilegePermission) { - throw new UnauthorizedError({ message: "Permission or privilegePermission must be provided" }); + throw new BadRequestError({ message: "Permission or privilegePermission must be provided" }); } const permission = privilegePermission @@ -224,7 +224,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F handler: async (req) => { const { permissions, privilegePermission, ...updatedInfo } = req.body.privilegeDetails; if (!permissions && !privilegePermission) { - throw new UnauthorizedError({ message: "Permission or privilegePermission must be provided" }); + throw new BadRequestError({ message: "Permission or privilegePermission must be provided" }); } const permission = privilegePermission diff --git a/backend/src/ee/routes/v1/rate-limit-router.ts b/backend/src/ee/routes/v1/rate-limit-router.ts index 1ba65405a..66ea62ece 100644 --- a/backend/src/ee/routes/v1/rate-limit-router.ts +++ b/backend/src/ee/routes/v1/rate-limit-router.ts @@ -1,7 +1,7 @@ import { z } from "zod"; import { RateLimitSchema } from "@app/db/schemas"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { readLimit } from "@app/server/config/rateLimiter"; import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; @@ -29,7 +29,7 @@ export const registerRateLimitRouter = async (server: FastifyZodProvider) => { handler: async () => { const rateLimit = await server.services.rateLimit.getRateLimits(); if (!rateLimit) { - throw new NotFoundError({ + throw new BadRequestError({ name: "Get Rate Limit Error", message: "Rate limit configuration does not exist." }); diff --git a/backend/src/ee/routes/v1/saml-router.ts b/backend/src/ee/routes/v1/saml-router.ts index 3d18a34cc..a5b0960b0 100644 --- a/backend/src/ee/routes/v1/saml-router.ts +++ b/backend/src/ee/routes/v1/saml-router.ts @@ -61,7 +61,7 @@ export const registerSamlRouter = async (server: FastifyZodProvider) => { id: samlConfigId }; } else { - throw new BadRequestError({ message: "Missing sso identifier or org slug" }); + throw new BadRequestError({ message: "Missing sso identitier or org slug" }); } const ssoConfig = await server.services.saml.getSaml(ssoLookupDetails); diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts index 96d95be85..7b0a2681f 100644 --- a/backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts +++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts @@ -1,10 +1,10 @@ import { ForbiddenError, subject } from "@casl/ability"; -import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { ActorType } from "@app/services/auth/auth-type"; import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission"; -import { TVerifyApprovers, VerifyApproversError } from "./access-approval-policy-types"; +import { TVerifyApprovers } from "./access-approval-policy-types"; export const verifyApprovers = async ({ userIds, @@ -13,8 +13,7 @@ export const verifyApprovers = async ({ envSlug, actorAuthMethod, secretPath, - permissionService, - error + permissionService }: TVerifyApprovers) => { for await (const userId of userIds) { try { @@ -31,16 +30,7 @@ export const verifyApprovers = async ({ subject(ProjectPermissionSub.Secrets, { environment: envSlug, secretPath }) ); } catch (err) { - if (error === VerifyApproversError.BadRequestError) { - throw new BadRequestError({ - message: "One or more approvers doesn't have access to be specified secret path" - }); - } - if (error === VerifyApproversError.ForbiddenError) { - throw new ForbiddenRequestError({ - message: "You don't have access to approve this request" - }); - } + throw new BadRequestError({ message: "One or more approvers doesn't have access to be specified secret path" }); } } }; diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts index 013444166..b9019b130 100644 --- a/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts +++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts @@ -19,8 +19,7 @@ import { TGetAccessApprovalPolicyByIdDTO, TGetAccessPolicyCountByEnvironmentDTO, TListAccessApprovalPoliciesDTO, - TUpdateAccessApprovalPolicy, - VerifyApproversError + TUpdateAccessApprovalPolicy } from "./access-approval-policy-types"; type TSecretApprovalPolicyServiceFactoryDep = { @@ -59,7 +58,7 @@ export const accessApprovalPolicyServiceFactory = ({ enforcementLevel }: TCreateAccessApprovalPolicy) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); // If there is a group approver people might be added to the group later to meet the approvers quota const groupApprovers = approvers @@ -90,7 +89,7 @@ export const accessApprovalPolicyServiceFactory = ({ ProjectPermissionSub.SecretApproval ); const env = await projectEnvDAL.findOne({ slug: environment, projectId: project.id }); - if (!env) throw new NotFoundError({ message: "Environment not found" }); + if (!env) throw new BadRequestError({ message: "Environment not found" }); let approverUserIds = userApprovers; if (userApproverNames.length) { @@ -140,8 +139,7 @@ export const accessApprovalPolicyServiceFactory = ({ secretPath, actorAuthMethod, permissionService, - userIds: verifyAllApprovers, - error: VerifyApproversError.BadRequestError + userIds: verifyAllApprovers }); const accessApproval = await accessApprovalPolicyDAL.transaction(async (tx) => { @@ -188,7 +186,7 @@ export const accessApprovalPolicyServiceFactory = ({ projectSlug }: TListAccessApprovalPoliciesDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); // Anyone in the project should be able to get the policies. /* const { permission } = */ await permissionService.getProjectPermission( @@ -239,7 +237,7 @@ export const accessApprovalPolicyServiceFactory = ({ throw new BadRequestError({ message: "Approvals cannot be greater than approvers" }); } - if (!accessApprovalPolicy) throw new NotFoundError({ message: "Secret approval policy not found" }); + if (!accessApprovalPolicy) throw new BadRequestError({ message: "Secret approval policy not found" }); const { permission } = await permissionService.getProjectPermission( actor, actorId, @@ -292,8 +290,7 @@ export const accessApprovalPolicyServiceFactory = ({ secretPath: doc.secretPath!, actorAuthMethod, permissionService, - userIds: userApproverIds, - error: VerifyApproversError.BadRequestError + userIds: userApproverIds }); await accessApprovalPolicyApproverDAL.insertMany( @@ -332,8 +329,7 @@ export const accessApprovalPolicyServiceFactory = ({ secretPath: doc.secretPath!, actorAuthMethod, permissionService, - userIds: verifyGroupApprovers, - error: VerifyApproversError.BadRequestError + userIds: verifyGroupApprovers }); await accessApprovalPolicyApproverDAL.insertMany( groupApprovers.map((groupId) => ({ @@ -361,7 +357,7 @@ export const accessApprovalPolicyServiceFactory = ({ actorOrgId }: TDeleteAccessApprovalPolicy) => { const policy = await accessApprovalPolicyDAL.findById(policyId); - if (!policy) throw new NotFoundError({ message: "Secret approval policy not found" }); + if (!policy) throw new BadRequestError({ message: "Secret approval policy not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -389,7 +385,7 @@ export const accessApprovalPolicyServiceFactory = ({ }: TGetAccessPolicyCountByEnvironmentDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const { membership } = await permissionService.getProjectPermission( actor, @@ -398,13 +394,13 @@ export const accessApprovalPolicyServiceFactory = ({ actorAuthMethod, actorOrgId ); - if (!membership) throw new NotFoundError({ message: "User not found in project" }); + if (!membership) throw new BadRequestError({ message: "User not found in project" }); const environment = await projectEnvDAL.findOne({ projectId: project.id, slug: envSlug }); - if (!environment) throw new NotFoundError({ message: "Environment not found" }); + if (!environment) throw new BadRequestError({ message: "Environment not found" }); const policies = await accessApprovalPolicyDAL.find({ envId: environment.id, projectId: project.id }); - if (!policies) throw new NotFoundError({ message: "No policies found" }); + if (!policies) throw new BadRequestError({ message: "No policies found" }); return { count: policies.length }; }; diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts index 8a5290581..bc8f23572 100644 --- a/backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts +++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-types.ts @@ -3,11 +3,6 @@ import { ActorAuthMethod } from "@app/services/auth/auth-type"; import { TPermissionServiceFactory } from "../permission/permission-service"; -export enum VerifyApproversError { - ForbiddenError = "ForbiddenError", - BadRequestError = "BadRequestError" -} - export type TVerifyApprovers = { userIds: string[]; permissionService: Pick; @@ -16,7 +11,6 @@ export type TVerifyApprovers = { secretPath: string; projectId: string; orgId: string; - error: VerifyApproversError; }; export enum ApproverType { diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-fns.ts b/backend/src/ee/services/access-approval-request/access-approval-request-fns.ts index fad19f12f..90b42aaf7 100644 --- a/backend/src/ee/services/access-approval-request/access-approval-request-fns.ts +++ b/backend/src/ee/services/access-approval-request/access-approval-request-fns.ts @@ -1,6 +1,6 @@ import { PackRule, unpackRules } from "@casl/ability/extra"; -import { BadRequestError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { TVerifyPermission } from "./access-approval-request-types"; @@ -19,7 +19,7 @@ export const verifyRequestedPermissions = ({ permissions }: TVerifyPermission) = ); if (!permission || !permission.length) { - throw new BadRequestError({ message: "No permission provided" }); + throw new UnauthorizedError({ message: "No permission provided" }); } const requestedPermissions: string[] = []; @@ -39,10 +39,10 @@ export const verifyRequestedPermissions = ({ permissions }: TVerifyPermission) = const permissionEnv = firstPermission.conditions?.environment; if (!permissionEnv || typeof permissionEnv !== "string") { - throw new BadRequestError({ message: "Permission environment is not a string" }); + throw new UnauthorizedError({ message: "Permission environment is not a string" }); } if (!permissionSecretPath || typeof permissionSecretPath !== "string") { - throw new BadRequestError({ message: "Permission path is not a string" }); + throw new UnauthorizedError({ message: "Permission path is not a string" }); } return { diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts index 4fab994ed..298109eeb 100644 --- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts +++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts @@ -3,7 +3,7 @@ import ms from "ms"; import { ProjectMembershipRole } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; @@ -18,7 +18,6 @@ import { TUserDALFactory } from "@app/services/user/user-dal"; import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-policy/access-approval-policy-approver-dal"; import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal"; import { verifyApprovers } from "../access-approval-policy/access-approval-policy-fns"; -import { VerifyApproversError } from "../access-approval-policy/access-approval-policy-types"; import { TGroupDALFactory } from "../group/group-dal"; import { TPermissionServiceFactory } from "../permission/permission-service"; import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal"; @@ -100,7 +99,7 @@ export const accessApprovalRequestServiceFactory = ({ }: TCreateAccessApprovalRequestDTO) => { const cfg = getConfig(); const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new ForbiddenRequestError({ message: "Project not found" }); + if (!project) throw new UnauthorizedError({ message: "Project not found" }); // Anyone can create an access approval request. const { membership } = await permissionService.getProjectPermission( @@ -110,23 +109,23 @@ export const accessApprovalRequestServiceFactory = ({ actorAuthMethod, actorOrgId ); - if (!membership) throw new ForbiddenRequestError({ message: "You are not a member of this project" }); + if (!membership) throw new UnauthorizedError({ message: "You are not a member of this project" }); const requestedByUser = await userDAL.findById(actorId); - if (!requestedByUser) throw new ForbiddenRequestError({ message: "User not found" }); + if (!requestedByUser) throw new UnauthorizedError({ message: "User not found" }); await projectDAL.checkProjectUpgradeStatus(project.id); const { envSlug, secretPath, accessTypes } = verifyRequestedPermissions({ permissions: requestedPermissions }); const environment = await projectEnvDAL.findOne({ projectId: project.id, slug: envSlug }); - if (!environment) throw new NotFoundError({ message: "Environment not found" }); + if (!environment) throw new UnauthorizedError({ message: "Environment not found" }); const policy = await accessApprovalPolicyDAL.findOne({ envId: environment.id, secretPath }); - if (!policy) throw new NotFoundError({ message: "No policy matching criteria was found." }); + if (!policy) throw new UnauthorizedError({ message: "No policy matching criteria was found." }); const approverIds: string[] = []; const approverGroupIds: string[] = []; @@ -263,7 +262,7 @@ export const accessApprovalRequestServiceFactory = ({ actorAuthMethod }: TListApprovalRequestsDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new UnauthorizedError({ message: "Project not found" }); const { membership } = await permissionService.getProjectPermission( actor, @@ -272,7 +271,7 @@ export const accessApprovalRequestServiceFactory = ({ actorAuthMethod, actorOrgId ); - if (!membership) throw new NotFoundError({ message: "You don't have a membership for the specified project" }); + if (!membership) throw new UnauthorizedError({ message: "You are not a member of this project" }); const policies = await accessApprovalPolicyDAL.find({ projectId: project.id }); let requests = await accessApprovalRequestDAL.findRequestsWithPrivilegeByPolicyIds(policies.map((p) => p.id)); @@ -297,7 +296,7 @@ export const accessApprovalRequestServiceFactory = ({ actorOrgId }: TReviewAccessRequestDTO) => { const accessApprovalRequest = await accessApprovalRequestDAL.findById(requestId); - if (!accessApprovalRequest) throw new NotFoundError({ message: "Secret approval request not found" }); + if (!accessApprovalRequest) throw new BadRequestError({ message: "Secret approval request not found" }); const { policy } = accessApprovalRequest; const { membership, hasRole } = await permissionService.getProjectPermission( @@ -308,14 +307,14 @@ export const accessApprovalRequestServiceFactory = ({ actorOrgId ); - if (!membership) throw new ForbiddenRequestError({ message: "You are not a member of this project" }); + if (!membership) throw new UnauthorizedError({ message: "You are not a member of this project" }); if ( !hasRole(ProjectMembershipRole.Admin) && accessApprovalRequest.requestedByUserId !== actorId && // The request wasn't made by the current user !policy.approvers.find((approver) => approver.userId === actorId) // The request isn't performed by an assigned approver ) { - throw new ForbiddenRequestError({ message: "You are not authorized to approve this request" }); + throw new UnauthorizedError({ message: "You are not authorized to approve this request" }); } const reviewerProjectMembership = await projectMembershipDAL.findById(membership.id); @@ -327,8 +326,7 @@ export const accessApprovalRequestServiceFactory = ({ secretPath: accessApprovalRequest.policy.secretPath!, actorAuthMethod, permissionService, - userIds: [reviewerProjectMembership.userId], - error: VerifyApproversError.ForbiddenError + userIds: [reviewerProjectMembership.userId] }); const existingReviews = await accessApprovalRequestReviewerDAL.find({ requestId: accessApprovalRequest.id }); @@ -413,7 +411,7 @@ export const accessApprovalRequestServiceFactory = ({ const getCount = async ({ projectSlug, actor, actorAuthMethod, actorId, actorOrgId }: TGetAccessRequestCountDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new UnauthorizedError({ message: "Project not found" }); const { membership } = await permissionService.getProjectPermission( actor, @@ -422,7 +420,7 @@ export const accessApprovalRequestServiceFactory = ({ actorAuthMethod, actorOrgId ); - if (!membership) throw new NotFoundError({ message: "You don't have a membership for the specified project" }); + if (!membership) throw new BadRequestError({ message: "User not found in project" }); const count = await accessApprovalRequestDAL.getCount({ projectId: project.id }); diff --git a/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts b/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts index 3172543c7..804f56871 100644 --- a/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts +++ b/backend/src/ee/services/audit-log-stream/audit-log-stream-service.ts @@ -5,7 +5,7 @@ import { SecretKeyEncoding } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; import { request } from "@app/lib/config/request"; import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator"; import { AUDIT_LOG_STREAM_TIMEOUT } from "../audit-log/audit-log-queue"; @@ -43,15 +43,14 @@ export const auditLogStreamServiceFactory = ({ actorOrgId, actorAuthMethod }: TCreateAuditLogStreamDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID attached to authentication token" }); + if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" }); const appCfg = getConfig(); const plan = await licenseService.getPlan(actorOrgId); - if (!plan.auditLogStreams) { + if (!plan.auditLogStreams) throw new BadRequestError({ message: "Failed to create audit log streams due to plan restriction. Upgrade plan to create group." }); - } const { permission } = await permissionService.getOrgPermission( actor, @@ -121,7 +120,7 @@ export const auditLogStreamServiceFactory = ({ actorOrgId, actorAuthMethod }: TUpdateAuditLogStreamDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID attached to authentication token" }); + if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" }); const plan = await licenseService.getPlan(actorOrgId); if (!plan.auditLogStreams) @@ -130,7 +129,7 @@ export const auditLogStreamServiceFactory = ({ }); const logStream = await auditLogStreamDAL.findById(id); - if (!logStream) throw new NotFoundError({ message: "Audit log stream not found" }); + if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" }); const { orgId } = logStream; const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); @@ -179,10 +178,10 @@ export const auditLogStreamServiceFactory = ({ }; const deleteById = async ({ id, actor, actorId, actorOrgId, actorAuthMethod }: TDeleteAuditLogStreamDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID attached to authentication token" }); + if (!actorOrgId) throw new BadRequestError({ message: "Missing org id from token" }); const logStream = await auditLogStreamDAL.findById(id); - if (!logStream) throw new NotFoundError({ message: "Audit log stream not found" }); + if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" }); const { orgId } = logStream; const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); @@ -194,7 +193,7 @@ export const auditLogStreamServiceFactory = ({ const getById = async ({ id, actor, actorId, actorOrgId, actorAuthMethod }: TGetDetailsAuditLogStreamDTO) => { const logStream = await auditLogStreamDAL.findById(id); - if (!logStream) throw new NotFoundError({ message: "Audit log stream not found" }); + if (!logStream) throw new BadRequestError({ message: "Audit log stream not found" }); const { orgId } = logStream; const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); diff --git a/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts b/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts index c2a8304c2..43f897a27 100644 --- a/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts +++ b/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts @@ -2,9 +2,10 @@ import { ForbiddenError } from "@casl/ability"; import * as x509 from "@peculiar/x509"; import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal"; +// import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; @@ -18,6 +19,7 @@ type TCertificateAuthorityCrlServiceFactoryDep = { projectDAL: Pick; kmsService: Pick; permissionService: Pick; + // licenseService: Pick; }; export type TCertificateAuthorityCrlServiceFactory = ReturnType; @@ -64,7 +66,7 @@ export const certificateAuthorityCrlServiceFactory = ({ */ const getCaCrls = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCrlsDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -79,6 +81,13 @@ export const certificateAuthorityCrlServiceFactory = ({ ProjectPermissionSub.CertificateAuthorities ); + // const plan = await licenseService.getPlan(actorOrgId); + // if (!plan.caCrl) + // throw new BadRequestError({ + // message: + // "Failed to get CA certificate revocation lists (CRLs) due to plan restriction. Upgrade plan to get the CA CRL." + // }); + const caCrls = await certificateAuthorityCrlDAL.find({ caId: ca.id }, { sort: [["createdAt", "desc"]] }); const keyId = await getProjectKmsCertificateKeyId({ diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts index 306c7ca26..1e5487d22 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts @@ -7,7 +7,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { getConfig } from "@app/lib/config/env"; import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; @@ -61,7 +61,7 @@ export const dynamicSecretLeaseServiceFactory = ({ }: TCreateDynamicSecretLeaseDTO) => { const appCfg = getConfig(); const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -84,10 +84,10 @@ export const dynamicSecretLeaseServiceFactory = ({ } const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id }); - if (!dynamicSecretCfg) throw new NotFoundError({ message: "Dynamic secret not found" }); + if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" }); const totalLeasesTaken = await dynamicSecretLeaseDAL.countLeasesForDynamicSecret(dynamicSecretCfg.id); if (totalLeasesTaken >= appCfg.MAX_LEASE_LIMIT) @@ -134,7 +134,7 @@ export const dynamicSecretLeaseServiceFactory = ({ leaseId }: TRenewDynamicSecretLeaseDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -157,10 +157,10 @@ export const dynamicSecretLeaseServiceFactory = ({ } const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretLease = await dynamicSecretLeaseDAL.findById(leaseId); - if (!dynamicSecretLease) throw new NotFoundError({ message: "Dynamic secret lease not found" }); + if (!dynamicSecretLease) throw new BadRequestError({ message: "Dynamic secret lease not found" }); const dynamicSecretCfg = dynamicSecretLease.dynamicSecret; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; @@ -208,7 +208,7 @@ export const dynamicSecretLeaseServiceFactory = ({ isForced }: TDeleteDynamicSecretLeaseDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -224,10 +224,10 @@ export const dynamicSecretLeaseServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretLease = await dynamicSecretLeaseDAL.findById(leaseId); - if (!dynamicSecretLease) throw new NotFoundError({ message: "Dynamic secret lease not found" }); + if (!dynamicSecretLease) throw new BadRequestError({ message: "Dynamic secret lease not found" }); const dynamicSecretCfg = dynamicSecretLease.dynamicSecret; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; @@ -273,7 +273,7 @@ export const dynamicSecretLeaseServiceFactory = ({ actorAuthMethod }: TListDynamicSecretLeasesDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -289,10 +289,10 @@ export const dynamicSecretLeaseServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id }); - if (!dynamicSecretCfg) throw new NotFoundError({ message: "Dynamic secret not found" }); + if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" }); const dynamicSecretLeases = await dynamicSecretLeaseDAL.find({ dynamicSecretId: dynamicSecretCfg.id }); return dynamicSecretLeases; @@ -309,7 +309,7 @@ export const dynamicSecretLeaseServiceFactory = ({ actorAuthMethod }: TDetailsDynamicSecretLeaseDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -325,10 +325,10 @@ export const dynamicSecretLeaseServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretLease = await dynamicSecretLeaseDAL.findById(leaseId); - if (!dynamicSecretLease) throw new NotFoundError({ message: "Dynamic secret lease not found" }); + if (!dynamicSecretLease) throw new BadRequestError({ message: "Dynamic secret lease not found" }); return dynamicSecretLease; }; diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts index eec9094cb..64883cbb5 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts @@ -5,7 +5,7 @@ import { TLicenseServiceFactory } from "@app/ee/services/license/license-service import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { OrderByDirection } from "@app/lib/types"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; @@ -66,7 +66,7 @@ export const dynamicSecretServiceFactory = ({ actorAuthMethod }: TCreateDynamicSecretDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -89,7 +89,7 @@ export const dynamicSecretServiceFactory = ({ } const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const existingDynamicSecret = await dynamicSecretDAL.findOne({ name, folderId: folder.id }); if (existingDynamicSecret) @@ -134,7 +134,7 @@ export const dynamicSecretServiceFactory = ({ actorAuthMethod }: TUpdateDynamicSecretDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; @@ -158,10 +158,10 @@ export const dynamicSecretServiceFactory = ({ } const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id }); - if (!dynamicSecretCfg) throw new NotFoundError({ message: "Dynamic secret not found" }); + if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" }); if (newName) { const existingDynamicSecret = await dynamicSecretDAL.findOne({ name: newName, folderId: folder.id }); @@ -213,7 +213,7 @@ export const dynamicSecretServiceFactory = ({ isForced }: TDeleteDynamicSecretDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; @@ -230,7 +230,7 @@ export const dynamicSecretServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id }); if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" }); @@ -271,7 +271,7 @@ export const dynamicSecretServiceFactory = ({ actor }: TDetailsDynamicSecretDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -287,10 +287,10 @@ export const dynamicSecretServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id }); - if (!dynamicSecretCfg) throw new NotFoundError({ message: "Dynamic secret not found" }); + if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" }); const decryptedStoredInput = JSON.parse( infisicalSymmetricDecrypt({ keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, @@ -335,7 +335,7 @@ export const dynamicSecretServiceFactory = ({ } const folders = await folderDAL.findBySecretPathMultiEnv(projectId, environmentSlugs, path); - if (!folders.length) throw new NotFoundError({ message: "Folders not found" }); + if (!folders.length) throw new BadRequestError({ message: "Folders not found" }); const dynamicSecretCfg = await dynamicSecretDAL.find( { $in: { folderId: folders.map((folder) => folder.id) }, $search: search ? { name: `%${search}%` } : undefined }, @@ -369,7 +369,7 @@ export const dynamicSecretServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretCfg = await dynamicSecretDAL.find( { folderId: folder.id, $search: search ? { name: `%${search}%` } : undefined }, @@ -398,7 +398,7 @@ export const dynamicSecretServiceFactory = ({ if (!projectId) { if (!projectSlug) throw new BadRequestError({ message: "Project ID or slug required" }); const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); projectId = project.id; } @@ -415,7 +415,7 @@ export const dynamicSecretServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const dynamicSecretCfg = await dynamicSecretDAL.find( { folderId: folder.id, $search: search ? { name: `%${search}%` } : undefined }, @@ -459,7 +459,7 @@ export const dynamicSecretServiceFactory = ({ } const folders = await folderDAL.findBySecretPathMultiEnv(projectId, environmentSlugs, path); - if (!folders.length) throw new NotFoundError({ message: "Folders not found" }); + if (!folders.length) throw new BadRequestError({ message: "Folders not found" }); const dynamicSecretCfg = await dynamicSecretDAL.listDynamicSecretsByFolderIds({ folderIds: folders.map((folder) => folder.id), diff --git a/backend/src/ee/services/external-kms/external-kms-service.ts b/backend/src/ee/services/external-kms/external-kms-service.ts index 49191b13a..491971a04 100644 --- a/backend/src/ee/services/external-kms/external-kms-service.ts +++ b/backend/src/ee/services/external-kms/external-kms-service.ts @@ -1,7 +1,7 @@ import { ForbiddenError } from "@casl/ability"; import slugify from "@sindresorhus/slugify"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TKmsKeyDALFactory } from "@app/services/kms/kms-key-dal"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; @@ -145,7 +145,7 @@ export const externalKmsServiceFactory = ({ const kmsSlug = slug ? slugify(slug) : undefined; const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); - if (!externalKmsDoc) throw new NotFoundError({ message: "External kms not found" }); + if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); let sanitizedProviderInput = ""; const { encryptor: orgDataKeyEncryptor, decryptor: orgDataKeyDecryptor } = @@ -220,7 +220,7 @@ export const externalKmsServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Kms); const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); - if (!externalKmsDoc) throw new NotFoundError({ message: "External kms not found" }); + if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); const externalKms = await externalKmsDAL.transaction(async (tx) => { const kms = await kmsDAL.deleteById(kmsDoc.id, tx); @@ -258,7 +258,7 @@ export const externalKmsServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms); const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); - if (!externalKmsDoc) throw new NotFoundError({ message: "External kms not found" }); + if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.Organization, @@ -298,7 +298,7 @@ export const externalKmsServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms); const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); - if (!externalKmsDoc) throw new NotFoundError({ message: "External kms not found" }); + if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.Organization, diff --git a/backend/src/ee/services/group/group-fns.ts b/backend/src/ee/services/group/group-fns.ts index 8d4843624..97c162c11 100644 --- a/backend/src/ee/services/group/group-fns.ts +++ b/backend/src/ee/services/group/group-fns.ts @@ -2,7 +2,7 @@ import { Knex } from "knex"; import { SecretKeyEncoding, TableName, TUsers } from "@app/db/schemas"; import { decryptAsymmetric, encryptAsymmetric, infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, ForbiddenRequestError, NotFoundError, ScimRequestError } from "@app/lib/errors"; +import { BadRequestError, ScimRequestError } from "@app/lib/errors"; import { TAddUsersToGroup, @@ -73,24 +73,24 @@ const addAcceptedUsersToGroup = async ({ const ghostUser = await projectDAL.findProjectGhostUser(projectId, tx); if (!ghostUser) { - throw new NotFoundError({ - message: "Failed to find project owner" + throw new BadRequestError({ + message: "Failed to find sudo user" }); } const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, projectId, tx); if (!ghostUserLatestKey) { - throw new NotFoundError({ - message: "Failed to find project owner's latest key" + throw new BadRequestError({ + message: "Failed to find sudo user latest key" }); } const bot = await projectBotDAL.findOne({ projectId }, tx); if (!bot) { - throw new NotFoundError({ - message: "Failed to find project bot" + throw new BadRequestError({ + message: "Failed to find bot" }); } @@ -200,7 +200,7 @@ export const addUsersToGroupByUserIds = async ({ userIds.forEach((userId) => { if (!existingUserOrgMembershipsUserIdsSet.has(userId)) - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: `User with id ${userId} is not part of the organization` }); }); @@ -303,7 +303,7 @@ export const removeUsersFromGroupByUserIds = async ({ userIds.forEach((userId) => { if (!existingUserGroupMembershipsUserIdsSet.has(userId)) - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: `User(s) are not part of the group ${group.slug}` }); }); @@ -415,7 +415,7 @@ export const convertPendingGroupAdditionsToGroupMemberships = async ({ const usersUserIdsSet = new Set(users.map((u) => u.id)); userIds.forEach((userId) => { if (!usersUserIdsSet.has(userId)) { - throw new NotFoundError({ + throw new BadRequestError({ message: `Failed to find user with id ${userId}` }); } diff --git a/backend/src/ee/services/group/group-service.ts b/backend/src/ee/services/group/group-service.ts index 9937bc280..c6b80135f 100644 --- a/backend/src/ee/services/group/group-service.ts +++ b/backend/src/ee/services/group/group-service.ts @@ -3,7 +3,7 @@ import slugify from "@sindresorhus/slugify"; import { OrgMembershipRole, TOrgRoles } from "@app/db/schemas"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; -import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal"; import { TOrgDALFactory } from "@app/services/org/org-dal"; @@ -62,7 +62,7 @@ export const groupServiceFactory = ({ licenseService }: TGroupServiceFactoryDep) => { const createGroup = async ({ name, slug, role, actor, actorId, actorAuthMethod, actorOrgId }: TCreateGroupDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" }); + if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -85,8 +85,7 @@ export const groupServiceFactory = ({ ); const isCustomRole = Boolean(customRole); const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission); - if (!hasRequiredPriviledges) - throw new ForbiddenRequestError({ message: "Failed to create a more privileged group" }); + if (!hasRequiredPriviledges) throw new BadRequestError({ message: "Failed to create a more privileged group" }); const group = await groupDAL.create({ name, @@ -109,7 +108,7 @@ export const groupServiceFactory = ({ actorAuthMethod, actorOrgId }: TUpdateGroupDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" }); + if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -128,7 +127,7 @@ export const groupServiceFactory = ({ const group = await groupDAL.findOne({ orgId: actorOrgId, id }); if (!group) { - throw new NotFoundError({ message: `Failed to find group with ID ${id}` }); + throw new BadRequestError({ message: `Failed to find group with ID ${id}` }); } let customRole: TOrgRoles | undefined; @@ -141,7 +140,7 @@ export const groupServiceFactory = ({ const isCustomRole = Boolean(customOrgRole); const hasRequiredNewRolePermission = isAtLeastAsPrivileged(permission, rolePermission); if (!hasRequiredNewRolePermission) - throw new ForbiddenRequestError({ message: "Failed to create a more privileged group" }); + throw new BadRequestError({ message: "Failed to create a more privileged group" }); if (isCustomRole) customRole = customOrgRole; } @@ -165,7 +164,7 @@ export const groupServiceFactory = ({ }; const deleteGroup = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TDeleteGroupDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" }); + if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -192,7 +191,9 @@ export const groupServiceFactory = ({ }; const getGroupById = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TGetGroupByIdDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" }); + if (!actorOrgId) { + throw new BadRequestError({ message: "Failed to read group without organization" }); + } const { permission } = await permissionService.getOrgPermission( actor, @@ -223,7 +224,7 @@ export const groupServiceFactory = ({ actorAuthMethod, actorOrgId }: TListGroupUsersDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" }); + if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -240,7 +241,7 @@ export const groupServiceFactory = ({ }); if (!group) - throw new NotFoundError({ + throw new BadRequestError({ message: `Failed to find group with ID ${id}` }); @@ -258,7 +259,7 @@ export const groupServiceFactory = ({ }; const addUserToGroup = async ({ id, username, actor, actorId, actorAuthMethod, actorOrgId }: TAddUserToGroupDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" }); + if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -276,7 +277,7 @@ export const groupServiceFactory = ({ }); if (!group) - throw new NotFoundError({ + throw new BadRequestError({ message: `Failed to find group with ID ${id}` }); @@ -288,7 +289,7 @@ export const groupServiceFactory = ({ throw new ForbiddenRequestError({ message: "Failed to add user to more privileged group" }); const user = await userDAL.findOne({ username }); - if (!user) throw new NotFoundError({ message: `Failed to find user with username ${username}` }); + if (!user) throw new BadRequestError({ message: `Failed to find user with username ${username}` }); const users = await addUsersToGroupByUserIds({ group, @@ -313,7 +314,7 @@ export const groupServiceFactory = ({ actorAuthMethod, actorOrgId }: TRemoveUserFromGroupDTO) => { - if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" }); + if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -331,7 +332,7 @@ export const groupServiceFactory = ({ }); if (!group) - throw new NotFoundError({ + throw new BadRequestError({ message: `Failed to find group with ID ${id}` }); @@ -343,7 +344,7 @@ export const groupServiceFactory = ({ throw new ForbiddenRequestError({ message: "Failed to delete user from more privileged group" }); const user = await userDAL.findOne({ username }); - if (!user) throw new NotFoundError({ message: `Failed to find user with username ${username}` }); + if (!user) throw new BadRequestError({ message: `Failed to find user with username ${username}` }); const users = await removeUsersFromGroupByUserIds({ group, diff --git a/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts b/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts index 7f2798258..70753ee09 100644 --- a/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts +++ b/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts @@ -4,7 +4,7 @@ import ms from "ms"; import { z } from "zod"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors"; import { ActorType } from "@app/services/auth/auth-type"; import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; @@ -71,12 +71,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ ...dto }: TCreateIdentityPrivilegeDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId }); if (!identityProjectMembership) - throw new NotFoundError({ message: `Failed to find identity with id ${identityId}` }); + throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` }); const { permission } = await permissionService.getProjectPermission( actor, @@ -143,12 +143,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ actorAuthMethod }: TUpdateIdentityPrivilegeDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId }); if (!identityProjectMembership) - throw new NotFoundError({ message: `Failed to find identity with id ${identityId}` }); + throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` }); const { permission } = await permissionService.getProjectPermission( actor, @@ -173,7 +173,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ slug, projectMembershipId: identityProjectMembership.id }); - if (!identityPrivilege) throw new NotFoundError({ message: "Identity additional privilege not found" }); + if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" }); if (data?.slug) { const existingSlug = await identityProjectAdditionalPrivilegeDAL.findOne({ slug: data.slug, @@ -224,12 +224,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ actorAuthMethod }: TDeleteIdentityPrivilegeDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId }); if (!identityProjectMembership) - throw new NotFoundError({ message: `Failed to find identity with id ${identityId}` }); + throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` }); const { permission } = await permissionService.getProjectPermission( actor, @@ -254,7 +254,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ slug, projectMembershipId: identityProjectMembership.id }); - if (!identityPrivilege) throw new NotFoundError({ message: "Identity additional privilege not found" }); + if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" }); const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id); return { @@ -274,12 +274,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ actorAuthMethod }: TGetIdentityPrivilegeDetailsDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId }); if (!identityProjectMembership) - throw new NotFoundError({ message: `Failed to find identity with id ${identityId}` }); + throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` }); const { permission } = await permissionService.getProjectPermission( actor, actorId, @@ -293,7 +293,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ slug, projectMembershipId: identityProjectMembership.id }); - if (!identityPrivilege) throw new NotFoundError({ message: "Identity additional privilege not found" }); + if (!identityPrivilege) throw new BadRequestError({ message: "Identity additional privilege not found" }); return { ...identityPrivilege, @@ -310,12 +310,12 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({ projectSlug }: TListIdentityPrivilegesDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId }); if (!identityProjectMembership) - throw new NotFoundError({ message: `Failed to find identity with id ${identityId}` }); + throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` }); const { permission } = await permissionService.getProjectPermission( actor, actorId, diff --git a/backend/src/ee/services/ldap-config/ldap-config-service.ts b/backend/src/ee/services/ldap-config/ldap-config-service.ts index ad2da3e23..6d09d5025 100644 --- a/backend/src/ee/services/ldap-config/ldap-config-service.ts +++ b/backend/src/ee/services/ldap-config/ldap-config-service.ts @@ -21,7 +21,7 @@ import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type"; import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service"; import { TokenType } from "@app/services/auth-token/auth-token-types"; @@ -253,7 +253,7 @@ export const ldapConfigServiceFactory = ({ }; const orgBot = await orgBotDAL.findOne({ orgId }); - if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, iv: orgBot.symmetricKeyIV, @@ -289,10 +289,10 @@ export const ldapConfigServiceFactory = ({ const getLdapCfg = async (filter: { orgId: string; isActive?: boolean; id?: string }) => { const ldapConfig = await ldapConfigDAL.findOne(filter); - if (!ldapConfig) throw new NotFoundError({ message: "Failed to find organization LDAP data" }); + if (!ldapConfig) throw new BadRequestError({ message: "Failed to find organization LDAP data" }); const orgBot = await orgBotDAL.findOne({ orgId: ldapConfig.orgId }); - if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, @@ -375,7 +375,7 @@ export const ldapConfigServiceFactory = ({ const bootLdap = async (organizationSlug: string) => { const organization = await orgDAL.findOne({ slug: organizationSlug }); - if (!organization) throw new NotFoundError({ message: "Organization not found" }); + if (!organization) throw new BadRequestError({ message: "Org not found" }); const ldapConfig = await getLdapCfg({ orgId: organization.id, @@ -420,7 +420,7 @@ export const ldapConfigServiceFactory = ({ const serverCfg = await getServerCfg(); if (serverCfg.enabledLoginMethods && !serverCfg.enabledLoginMethods.includes(LoginMethod.LDAP)) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "Login with LDAP is disabled by administrator." }); } @@ -432,7 +432,7 @@ export const ldapConfigServiceFactory = ({ }); const organization = await orgDAL.findOrgById(orgId); - if (!organization) throw new NotFoundError({ message: "Organization not found" }); + if (!organization) throw new BadRequestError({ message: "Org not found" }); if (userAlias) { await userDAL.transaction(async (tx) => { @@ -700,7 +700,7 @@ export const ldapConfigServiceFactory = ({ orgId }); - if (!ldapConfig) throw new NotFoundError({ message: "Failed to find organization LDAP data" }); + if (!ldapConfig) throw new BadRequestError({ message: "Failed to find organization LDAP data" }); const groupMaps = await ldapGroupMapDAL.findLdapGroupMapsByLdapConfigId(ldapConfigId); @@ -741,13 +741,13 @@ export const ldapConfigServiceFactory = ({ const groups = await searchGroups(ldapConfig, groupSearchFilter, ldapConfig.groupSearchBase); if (!groups.some((g) => g.cn === ldapGroupCN)) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Failed to find LDAP Group CN" }); } const group = await groupDAL.findOne({ slug: groupSlug, orgId }); - if (!group) throw new NotFoundError({ message: "Failed to find group" }); + if (!group) throw new BadRequestError({ message: "Failed to find group" }); const groupMap = await ldapGroupMapDAL.create({ ldapConfigId, @@ -781,7 +781,7 @@ export const ldapConfigServiceFactory = ({ orgId }); - if (!ldapConfig) throw new NotFoundError({ message: "Failed to find organization LDAP data" }); + if (!ldapConfig) throw new BadRequestError({ message: "Failed to find organization LDAP data" }); const [deletedGroupMap] = await ldapGroupMapDAL.delete({ ldapConfigId: ldapConfig.id, diff --git a/backend/src/ee/services/license/license-service.ts b/backend/src/ee/services/license/license-service.ts index 2f06f35cf..28a9af445 100644 --- a/backend/src/ee/services/license/license-service.ts +++ b/backend/src/ee/services/license/license-service.ts @@ -10,7 +10,7 @@ import { Knex } from "knex"; import { TKeyStoreFactory } from "@app/keystore/keystore"; import { getConfig } from "@app/lib/config/env"; import { verifyOfflineLicense } from "@app/lib/crypto"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { TOrgDALFactory } from "@app/services/org/org-dal"; @@ -145,7 +145,7 @@ export const licenseServiceFactory = ({ if (cachedPlan) return JSON.parse(cachedPlan) as TFeatureSet; const org = await orgDAL.findOrgById(orgId); - if (!org) throw new NotFoundError({ message: "Organization not found" }); + if (!org) throw new BadRequestError({ message: "Org not found" }); const { data: { currentPlan } } = await licenseServerCloudApi.request.get<{ currentPlan: TFeatureSet }>( @@ -204,7 +204,7 @@ export const licenseServiceFactory = ({ const updateSubscriptionOrgMemberCount = async (orgId: string, tx?: Knex) => { if (instanceType === InstanceType.Cloud) { const org = await orgDAL.findOrgById(orgId); - if (!org) throw new NotFoundError({ message: "Organization not found" }); + if (!org) throw new BadRequestError({ message: "Org not found" }); const quantity = await licenseDAL.countOfOrgMembers(orgId, tx); const quantityIdentities = await licenseDAL.countOrgUsersAndIdentities(orgId, tx); @@ -266,8 +266,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -294,8 +294,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -340,8 +340,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } const { data } = await licenseServerCloudApi.request.get( @@ -357,8 +357,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } const { data } = await licenseServerCloudApi.request.get( @@ -373,8 +373,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -398,8 +398,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } const { data } = await licenseServerCloudApi.request.patch( @@ -418,8 +418,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -445,8 +445,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } const { @@ -474,8 +474,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -491,8 +491,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } const { @@ -509,8 +509,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -530,8 +530,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -547,8 +547,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } @@ -564,8 +564,8 @@ export const licenseServiceFactory = ({ const organization = await orgDAL.findOrgById(orgId); if (!organization) { - throw new NotFoundError({ - message: "Organization not found" + throw new BadRequestError({ + message: "Failed to find organization" }); } diff --git a/backend/src/ee/services/oidc/oidc-config-service.ts b/backend/src/ee/services/oidc/oidc-config-service.ts index 53a23d841..f86f29646 100644 --- a/backend/src/ee/services/oidc/oidc-config-service.ts +++ b/backend/src/ee/services/oidc/oidc-config-service.ts @@ -17,7 +17,7 @@ import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type"; import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service"; import { TokenType } from "@app/services/auth-token/auth-token-types"; @@ -77,7 +77,7 @@ export const oidcConfigServiceFactory = ({ const getOidc = async (dto: TGetOidcCfgDTO) => { const org = await orgDAL.findOne({ slug: dto.orgSlug }); if (!org) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Organization not found", name: "OrgNotFound" }); @@ -98,7 +98,7 @@ export const oidcConfigServiceFactory = ({ }); if (!oidcCfg) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Failed to find organization OIDC configuration" }); } @@ -106,7 +106,7 @@ export const oidcConfigServiceFactory = ({ // decrypt and return cfg const orgBot = await orgBotDAL.findOne({ orgId: oidcCfg.orgId }); if (!orgBot) { - throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); } const key = infisicalSymmetricDecrypt({ @@ -160,7 +160,7 @@ export const oidcConfigServiceFactory = ({ const serverCfg = await getServerCfg(); if (serverCfg.enabledLoginMethods && !serverCfg.enabledLoginMethods.includes(LoginMethod.OIDC)) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "Login with OIDC is disabled by administrator." }); } @@ -173,7 +173,7 @@ export const oidcConfigServiceFactory = ({ }); const organization = await orgDAL.findOrgById(orgId); - if (!organization) throw new NotFoundError({ message: "Organization not found" }); + if (!organization) throw new BadRequestError({ message: "Org not found" }); let user: TUsers; if (userAlias) { @@ -356,7 +356,7 @@ export const oidcConfigServiceFactory = ({ }); if (!org) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Organization not found" }); } @@ -378,7 +378,7 @@ export const oidcConfigServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso); const orgBot = await orgBotDAL.findOne({ orgId: org.id }); - if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, iv: orgBot.symmetricKeyIV, @@ -443,7 +443,7 @@ export const oidcConfigServiceFactory = ({ slug: orgSlug }); if (!org) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Organization not found" }); } @@ -549,7 +549,7 @@ export const oidcConfigServiceFactory = ({ }); if (!org) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Organization not found." }); } @@ -560,7 +560,7 @@ export const oidcConfigServiceFactory = ({ }); if (!oidcCfg || !oidcCfg.isActive) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "Failed to authenticate with OIDC SSO" }); } @@ -617,7 +617,7 @@ export const oidcConfigServiceFactory = ({ if (oidcCfg.allowedEmailDomains) { const allowedDomains = oidcCfg.allowedEmailDomains.split(", "); if (!allowedDomains.includes(claims.email.split("@")[1])) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "Email not allowed." }); } diff --git a/backend/src/ee/services/permission/permission-fns.ts b/backend/src/ee/services/permission/permission-fns.ts index c4b38288a..eda19c215 100644 --- a/backend/src/ee/services/permission/permission-fns.ts +++ b/backend/src/ee/services/permission/permission-fns.ts @@ -1,5 +1,5 @@ import { TOrganizations } from "@app/db/schemas"; -import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { ActorAuthMethod, AuthMethod } from "@app/services/auth/auth-type"; function isAuthMethodSaml(actorAuthMethod: ActorAuthMethod) { @@ -20,7 +20,7 @@ function validateOrgSAML(actorAuthMethod: ActorAuthMethod, isSamlEnforced: TOrga } if (isSamlEnforced && actorAuthMethod !== null && !isAuthMethodSaml(actorAuthMethod)) { - throw new ForbiddenRequestError({ name: "SAML auth enforced, cannot access org-scoped resource" }); + throw new UnauthorizedError({ name: "Cannot access org-scoped resource" }); } } diff --git a/backend/src/ee/services/permission/permission-service.ts b/backend/src/ee/services/permission/permission-service.ts index 3871f6b45..cb1e84677 100644 --- a/backend/src/ee/services/permission/permission-service.ts +++ b/backend/src/ee/services/permission/permission-service.ts @@ -10,7 +10,7 @@ import { TProjectMemberships } from "@app/db/schemas"; import { conditionsMatcher } from "@app/lib/casl"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type"; import { TOrgRoleDALFactory } from "@app/services/org/org-role-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; @@ -62,7 +62,7 @@ export const permissionServiceFactory = ({ permissions as PackRule>>[] ); default: - throw new NotFoundError({ name: "OrgRoleInvalid", message: "Organization role not found" }); + throw new BadRequestError({ name: "OrgRoleInvalid", message: "Org role not found" }); } }) .reduce((curr, prev) => prev.concat(curr), []); @@ -90,7 +90,7 @@ export const permissionServiceFactory = ({ ); } default: - throw new NotFoundError({ + throw new BadRequestError({ name: "ProjectRoleInvalid", message: "Project role not found" }); @@ -114,11 +114,11 @@ export const permissionServiceFactory = ({ ) => { // when token is scoped, ensure the passed org id is same as user org id if (userOrgId && userOrgId !== orgId) - throw new ForbiddenRequestError({ message: "Invalid user token. Scoped to different organization." }); + throw new BadRequestError({ message: "Invalid user token. Scoped to different organization." }); const membership = await permissionDAL.getOrgPermission(userId, orgId); - if (!membership) throw new ForbiddenRequestError({ name: "User is not a part of the specified organization" }); + if (!membership) throw new UnauthorizedError({ name: "User not in org" }); if (membership.role === OrgMembershipRole.Custom && !membership.permissions) { - throw new BadRequestError({ name: "Custom organization permission not found" }); + throw new BadRequestError({ name: "Custom permission not found" }); } // If the org ID is API_KEY, the request is being made with an API Key. @@ -127,7 +127,7 @@ export const permissionServiceFactory = ({ // Extra: This means that when users are using API keys to make requests, they can't use slug-based routes. // Slug-based routes depend on the organization ID being present on the request, since project slugs aren't globally unique, and we need a way to filter by organization. if (userOrgId !== "API_KEY" && membership.orgId !== userOrgId) { - throw new ForbiddenRequestError({ name: "You are not logged into this organization" }); + throw new UnauthorizedError({ name: "You are not logged into this organization" }); } validateOrgSAML(authMethod, membership.orgAuthEnforced); @@ -143,9 +143,9 @@ export const permissionServiceFactory = ({ const getIdentityOrgPermission = async (identityId: string, orgId: string) => { const membership = await permissionDAL.getOrgIdentityPermission(identityId, orgId); - if (!membership) throw new ForbiddenRequestError({ name: "Identity is not a part of the specified organization" }); + if (!membership) throw new UnauthorizedError({ name: "Identity not in org" }); if (membership.role === OrgMembershipRole.Custom && !membership.permissions) { - throw new NotFoundError({ name: "Custom organization permission not found" }); + throw new BadRequestError({ name: "Custom permission not found" }); } return { permission: buildOrgPermission([{ role: membership.role, permissions: membership.permissions }]), @@ -166,8 +166,8 @@ export const permissionServiceFactory = ({ case ActorType.IDENTITY: return getIdentityOrgPermission(id, orgId); default: - throw new BadRequestError({ - message: "Invalid actor provided", + throw new UnauthorizedError({ + message: "Permission not defined", name: "Get org permission" }); } @@ -179,7 +179,7 @@ export const permissionServiceFactory = ({ const isCustomRole = !Object.values(OrgMembershipRole).includes(role as OrgMembershipRole); if (isCustomRole) { const orgRole = await orgRoleDAL.findOne({ slug: role, orgId }); - if (!orgRole) throw new NotFoundError({ message: "Specified role was not found" }); + if (!orgRole) throw new BadRequestError({ message: "Role not found" }); return { permission: buildOrgPermission([{ role: OrgMembershipRole.Custom, permissions: orgRole.permissions }]), role: orgRole @@ -196,12 +196,12 @@ export const permissionServiceFactory = ({ userOrgId?: string ): Promise> => { const userProjectPermission = await permissionDAL.getProjectPermission(userId, projectId); - if (!userProjectPermission) throw new ForbiddenRequestError({ name: "User not a part of the specified project" }); + if (!userProjectPermission) throw new UnauthorizedError({ name: "User not in project" }); if ( userProjectPermission.roles.some(({ role, permissions }) => role === ProjectMembershipRole.Custom && !permissions) ) { - throw new NotFoundError({ name: "The permission was not found" }); + throw new BadRequestError({ name: "Custom permission not found" }); } // If the org ID is API_KEY, the request is being made with an API Key. @@ -210,7 +210,7 @@ export const permissionServiceFactory = ({ // Extra: This means that when users are using API keys to make requests, they can't use slug-based routes. // Slug-based routes depend on the organization ID being present on the request, since project slugs aren't globally unique, and we need a way to filter by organization. if (userOrgId !== "API_KEY" && userProjectPermission.orgId !== userOrgId) { - throw new ForbiddenRequestError({ name: "You are not logged into this organization" }); + throw new UnauthorizedError({ name: "You are not logged into this organization" }); } validateOrgSAML(authMethod, userProjectPermission.orgAuthEnforced); @@ -239,19 +239,18 @@ export const permissionServiceFactory = ({ identityOrgId: string | undefined ): Promise> => { const identityProjectPermission = await permissionDAL.getProjectIdentityPermission(identityId, projectId); - if (!identityProjectPermission) - throw new ForbiddenRequestError({ name: "Identity is not a member of the specified project" }); + if (!identityProjectPermission) throw new UnauthorizedError({ name: "Identity not in project" }); if ( identityProjectPermission.roles.some( ({ role, permissions }) => role === ProjectMembershipRole.Custom && !permissions ) ) { - throw new NotFoundError({ name: "Custom permission not found" }); + throw new BadRequestError({ name: "Custom permission not found" }); } if (identityProjectPermission.orgId !== identityOrgId) { - throw new ForbiddenRequestError({ name: "Identity is not a member of the specified organization" }); + throw new UnauthorizedError({ name: "You are not a member of this organization" }); } const rolePermissions = @@ -278,23 +277,25 @@ export const permissionServiceFactory = ({ actorOrgId: string | undefined ) => { const serviceToken = await serviceTokenDAL.findById(serviceTokenId); - if (!serviceToken) throw new NotFoundError({ message: "Service token not found" }); + if (!serviceToken) throw new BadRequestError({ message: "Service token not found" }); const serviceTokenProject = await projectDAL.findById(serviceToken.projectId); if (!serviceTokenProject) throw new BadRequestError({ message: "Service token not linked to a project" }); if (serviceTokenProject.orgId !== actorOrgId) { - throw new ForbiddenRequestError({ message: "Service token not a part of the specified organization" }); + throw new UnauthorizedError({ message: "Service token not a part of this organization" }); } - if (serviceToken.projectId !== projectId) { - throw new ForbiddenRequestError({ name: "Service token not a part of the specified project" }); - } + if (serviceToken.projectId !== projectId) + throw new UnauthorizedError({ + message: "Failed to find service authorization for given project" + }); - if (serviceTokenProject.orgId !== actorOrgId) { - throw new ForbiddenRequestError({ message: "Service token not a part of the specified organization" }); - } + if (serviceTokenProject.orgId !== actorOrgId) + throw new UnauthorizedError({ + message: "Failed to find service authorization for given project" + }); const scopes = ServiceTokenScopes.parse(serviceToken.scopes || []); return { @@ -334,8 +335,8 @@ export const permissionServiceFactory = ({ case ActorType.IDENTITY: return getIdentityProjectPermission(id, projectId, actorOrgId) as Promise>; default: - throw new BadRequestError({ - message: "Invalid actor provided", + throw new UnauthorizedError({ + message: "Permission not defined", name: "Get project permission" }); } @@ -345,7 +346,7 @@ export const permissionServiceFactory = ({ const isCustomRole = !Object.values(ProjectMembershipRole).includes(role as ProjectMembershipRole); if (isCustomRole) { const projectRole = await projectRoleDAL.findOne({ slug: role, projectId }); - if (!projectRole) throw new NotFoundError({ message: `Specified role was not found: ${role}` }); + if (!projectRole) throw new BadRequestError({ message: `Role not found: ${role}` }); return { permission: buildProjectPermission([ { role: ProjectMembershipRole.Custom, permissions: projectRole.permissions } diff --git a/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts b/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts index ea46e132c..c5b06cad5 100644 --- a/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts +++ b/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts @@ -1,7 +1,7 @@ import { ForbiddenError } from "@casl/ability"; import ms from "ms"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal"; import { TPermissionServiceFactory } from "../permission/permission-service"; @@ -42,7 +42,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ ...dto }: TCreateUserPrivilegeDTO) => { const projectMembership = await projectMembershipDAL.findById(projectMembershipId); - if (!projectMembership) throw new NotFoundError({ message: "Project membership not found" }); + if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -94,14 +94,14 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ ...dto }: TUpdateUserPrivilegeDTO) => { const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId); - if (!userPrivilege) throw new NotFoundError({ message: "User additional privilege not found" }); + if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" }); const projectMembership = await projectMembershipDAL.findOne({ userId: userPrivilege.userId, projectId: userPrivilege.projectId }); - if (!projectMembership) throw new NotFoundError({ message: "Project membership not found" }); + if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -147,13 +147,13 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ const deleteById = async ({ actorId, actor, actorOrgId, actorAuthMethod, privilegeId }: TDeleteUserPrivilegeDTO) => { const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId); - if (!userPrivilege) throw new NotFoundError({ message: "User additional privilege not found" }); + if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" }); const projectMembership = await projectMembershipDAL.findOne({ userId: userPrivilege.userId, projectId: userPrivilege.projectId }); - if (!projectMembership) throw new NotFoundError({ message: "Project membership not found" }); + if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -176,13 +176,13 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ actorAuthMethod }: TGetUserPrivilegeDetailsDTO) => { const userPrivilege = await projectUserAdditionalPrivilegeDAL.findById(privilegeId); - if (!userPrivilege) throw new NotFoundError({ message: "User additional privilege not found" }); + if (!userPrivilege) throw new BadRequestError({ message: "User additional privilege not found" }); const projectMembership = await projectMembershipDAL.findOne({ userId: userPrivilege.userId, projectId: userPrivilege.projectId }); - if (!projectMembership) throw new NotFoundError({ message: "Project membership not found" }); + if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -204,7 +204,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({ actorAuthMethod }: TListUserPrivilegesDTO) => { const projectMembership = await projectMembershipDAL.findById(projectMembershipId); - if (!projectMembership) throw new NotFoundError({ message: "Project membership not found" }); + if (!projectMembership) throw new BadRequestError({ message: "Project membership not found" }); const { permission } = await permissionService.getProjectPermission( actor, diff --git a/backend/src/ee/services/saml-config/saml-config-service.ts b/backend/src/ee/services/saml-config/saml-config-service.ts index dd184f01f..5779b73f6 100644 --- a/backend/src/ee/services/saml-config/saml-config-service.ts +++ b/backend/src/ee/services/saml-config/saml-config-service.ts @@ -19,7 +19,7 @@ import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { AuthTokenType } from "@app/services/auth/auth-type"; import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service"; import { TokenType } from "@app/services/auth-token/auth-token-types"; @@ -187,7 +187,7 @@ export const samlConfigServiceFactory = ({ const updateQuery: TSamlConfigsUpdate = { authProvider, isActive, lastUsed: null }; const orgBot = await orgBotDAL.findOne({ orgId }); - if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, iv: orgBot.symmetricKeyIV, @@ -253,7 +253,7 @@ export const samlConfigServiceFactory = ({ ssoConfig = await samlConfigDAL.findById(id); } - if (!ssoConfig) throw new NotFoundError({ message: "Failed to find organization SSO data" }); + if (!ssoConfig) throw new BadRequestError({ message: "Failed to find organization SSO data" }); // when dto is type id means it's internally used if (dto.type === "org") { @@ -279,7 +279,7 @@ export const samlConfigServiceFactory = ({ } = ssoConfig; const orgBot = await orgBotDAL.findOne({ orgId: ssoConfig.orgId }); - if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, iv: orgBot.symmetricKeyIV, @@ -338,7 +338,7 @@ export const samlConfigServiceFactory = ({ const serverCfg = await getServerCfg(); if (serverCfg.enabledLoginMethods && !serverCfg.enabledLoginMethods.includes(LoginMethod.SAML)) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "Login with SAML is disabled by administrator." }); } @@ -350,7 +350,7 @@ export const samlConfigServiceFactory = ({ }); const organization = await orgDAL.findOrgById(orgId); - if (!organization) throw new NotFoundError({ message: "Organization not found" }); + if (!organization) throw new BadRequestError({ message: "Org not found" }); let user: TUsers; if (userAlias) { diff --git a/backend/src/ee/services/scim/scim-service.ts b/backend/src/ee/services/scim/scim-service.ts index 732f37f42..482bc4cc7 100644 --- a/backend/src/ee/services/scim/scim-service.ts +++ b/backend/src/ee/services/scim/scim-service.ts @@ -9,7 +9,7 @@ import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal"; import { TScimDALFactory } from "@app/ee/services/scim/scim-dal"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, NotFoundError, ScimRequestError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, ScimRequestError, UnauthorizedError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TOrgPermission } from "@app/lib/types"; import { AuthTokenType } from "@app/services/auth/auth-type"; @@ -176,7 +176,7 @@ export const scimServiceFactory = ({ const deleteScimToken = async ({ scimTokenId, actor, actorId, actorAuthMethod, actorOrgId }: TDeleteScimTokenDTO) => { let scimToken = await scimDAL.findById(scimTokenId); - if (!scimToken) throw new NotFoundError({ message: "Failed to find SCIM token to delete" }); + if (!scimToken) throw new BadRequestError({ message: "Failed to find SCIM token to delete" }); const { permission } = await permissionService.getOrgPermission( actor, diff --git a/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts b/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts index 1908e75af..522989fc0 100644 --- a/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts +++ b/backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts @@ -95,7 +95,7 @@ export const secretApprovalPolicyServiceFactory = ({ } const env = await projectEnvDAL.findOne({ slug: environment, projectId }); - if (!env) throw new NotFoundError({ message: "Environment not found" }); + if (!env) throw new BadRequestError({ message: "Environment not found" }); const secretApproval = await secretApprovalPolicyDAL.transaction(async (tx) => { const doc = await secretApprovalPolicyDAL.create( @@ -178,7 +178,7 @@ export const secretApprovalPolicyServiceFactory = ({ .filter(Boolean) as string[]; const secretApprovalPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId); - if (!secretApprovalPolicy) throw new NotFoundError({ message: "Secret approval policy not found" }); + if (!secretApprovalPolicy) throw new BadRequestError({ message: "Secret approval policy not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -271,7 +271,7 @@ export const secretApprovalPolicyServiceFactory = ({ actorOrgId }: TDeleteSapDTO) => { const sapPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId); - if (!sapPolicy) throw new NotFoundError({ message: "Secret approval policy not found" }); + if (!sapPolicy) throw new BadRequestError({ message: "Secret approval policy not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -320,7 +320,7 @@ export const secretApprovalPolicyServiceFactory = ({ const getSecretApprovalPolicy = async (projectId: string, environment: string, path: string) => { const secretPath = removeTrailingSlash(path); const env = await projectEnvDAL.findOne({ slug: environment, projectId }); - if (!env) throw new NotFoundError({ message: "Environment not found" }); + if (!env) throw new BadRequestError({ message: "Environment not found" }); const policies = await secretApprovalPolicyDAL.find({ envId: env.id }); if (!policies.length) return; diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts index 77f38dd53..592f6ccd0 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts @@ -8,7 +8,7 @@ import { TSecretApprovalRequestsSecrets, TSecretTags } from "@app/db/schemas"; -import { DatabaseError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, DatabaseError } from "@app/lib/errors"; import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex"; export type TSecretApprovalRequestSecretDALFactory = ReturnType; @@ -31,7 +31,7 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => { ); if (existingApprovalSecrets.length !== data.length) { - throw new NotFoundError({ message: "Some of the secret approvals do not exist" }); + throw new BadRequestError({ message: "Some of the secret approvals do not exist" }); } if (data.length === 0) return []; diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index bbc099956..ad476bbab 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -10,7 +10,7 @@ import { } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { groupBy, pick, unique } from "@app/lib/fn"; import { setKnexStringValue } from "@app/lib/knex"; import { alphaNumericNanoId } from "@app/lib/nanoid"; @@ -204,7 +204,7 @@ export const secretApprovalRequestServiceFactory = ({ if (actor === ActorType.SERVICE) throw new BadRequestError({ message: "Cannot use service token" }); const secretApprovalRequest = await secretApprovalRequestDAL.findById(id); - if (!secretApprovalRequest) throw new NotFoundError({ message: "Secret approval request not found" }); + if (!secretApprovalRequest) throw new BadRequestError({ message: "Secret approval request not found" }); const { projectId } = secretApprovalRequest; const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); @@ -222,7 +222,7 @@ export const secretApprovalRequestServiceFactory = ({ secretApprovalRequest.committerUserId !== actorId && !policy.approvers.find(({ userId }) => userId === actorId) ) { - throw new ForbiddenRequestError({ message: "User has insufficient privileges" }); + throw new UnauthorizedError({ message: "User has no access" }); } let secrets; @@ -271,7 +271,7 @@ export const secretApprovalRequestServiceFactory = ({ : undefined })); } else { - if (!botKey) throw new NotFoundError({ message: "Project bot key not found" }); + if (!botKey) throw new BadRequestError({ message: "Bot key not found" }); const encrypedSecrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id); secrets = encrypedSecrets.map((el) => ({ ...el, @@ -307,7 +307,7 @@ export const secretApprovalRequestServiceFactory = ({ actorOrgId }: TReviewRequestDTO) => { const secretApprovalRequest = await secretApprovalRequestDAL.findById(approvalId); - if (!secretApprovalRequest) throw new NotFoundError({ message: "Secret approval request not found" }); + if (!secretApprovalRequest) throw new BadRequestError({ message: "Secret approval request not found" }); if (actor !== ActorType.USER) throw new BadRequestError({ message: "Must be a user" }); const plan = await licenseService.getPlan(actorOrgId); @@ -331,7 +331,7 @@ export const secretApprovalRequestServiceFactory = ({ secretApprovalRequest.committerUserId !== actorId && !policy.approvers.find(({ userId }) => userId === actorId) ) { - throw new ForbiddenRequestError({ message: "User has insufficient privileges" }); + throw new UnauthorizedError({ message: "User has no access" }); } const reviewStatus = await secretApprovalRequestReviewerDAL.transaction(async (tx) => { const review = await secretApprovalRequestReviewerDAL.findOne( @@ -365,7 +365,7 @@ export const secretApprovalRequestServiceFactory = ({ actorAuthMethod }: TStatusChangeDTO) => { const secretApprovalRequest = await secretApprovalRequestDAL.findById(approvalId); - if (!secretApprovalRequest) throw new NotFoundError({ message: "Secret approval request not found" }); + if (!secretApprovalRequest) throw new BadRequestError({ message: "Secret approval request not found" }); if (actor !== ActorType.USER) throw new BadRequestError({ message: "Must be a user" }); const plan = await licenseService.getPlan(actorOrgId); @@ -389,7 +389,7 @@ export const secretApprovalRequestServiceFactory = ({ secretApprovalRequest.committerUserId !== actorId && !policy.approvers.find(({ userId }) => userId === actorId) ) { - throw new ForbiddenRequestError({ message: "User has insufficient privileges" }); + throw new UnauthorizedError({ message: "User has no access" }); } if (secretApprovalRequest.hasMerged) throw new BadRequestError({ message: "Approval request has been merged" }); @@ -414,7 +414,7 @@ export const secretApprovalRequestServiceFactory = ({ bypassReason }: TMergeSecretApprovalRequestDTO) => { const secretApprovalRequest = await secretApprovalRequestDAL.findById(approvalId); - if (!secretApprovalRequest) throw new NotFoundError({ message: "Secret approval request not found" }); + if (!secretApprovalRequest) throw new BadRequestError({ message: "Secret approval request not found" }); if (actor !== ActorType.USER) throw new BadRequestError({ message: "Must be a user" }); const plan = await licenseService.getPlan(actorOrgId); @@ -439,7 +439,7 @@ export const secretApprovalRequestServiceFactory = ({ secretApprovalRequest.committerUserId !== actorId && !policy.approvers.find(({ userId }) => userId === actorId) ) { - throw new ForbiddenRequestError({ message: "User has insufficient privileges" }); + throw new UnauthorizedError({ message: "User has no access" }); } const reviewers = secretApprovalRequest.reviewers.reduce>( (prev, curr) => ({ ...prev, [curr.userId.toString()]: curr.status as ApprovalStatus }), @@ -462,7 +462,7 @@ export const secretApprovalRequestServiceFactory = ({ const secretApprovalSecrets = await secretApprovalRequestSecretDAL.findByRequestIdBridgeSecretV2( secretApprovalRequest.id ); - if (!secretApprovalSecrets) throw new NotFoundError({ message: "No secrets found" }); + if (!secretApprovalSecrets) throw new BadRequestError({ message: "No secrets found" }); const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, @@ -602,7 +602,7 @@ export const secretApprovalRequestServiceFactory = ({ }); } else { const secretApprovalSecrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id); - if (!secretApprovalSecrets) throw new NotFoundError({ message: "No secrets found" }); + if (!secretApprovalSecrets) throw new BadRequestError({ message: "No secrets found" }); const conflicts: Array<{ secretId: string; op: SecretOperations }> = []; let secretCreationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Create); @@ -612,8 +612,8 @@ export const secretApprovalRequestServiceFactory = ({ secretDAL, inputSecrets: secretCreationCommits.map(({ secretBlindIndex }) => { if (!secretBlindIndex) { - throw new NotFoundError({ - message: "Secret blind index not found" + throw new BadRequestError({ + message: "Missing secret blind index" }); } return { secretBlindIndex }; @@ -639,8 +639,8 @@ export const secretApprovalRequestServiceFactory = ({ .filter(({ secretBlindIndex, secret }) => secret && secret.secretBlindIndex !== secretBlindIndex) .map(({ secretBlindIndex }) => { if (!secretBlindIndex) { - throw new NotFoundError({ - message: "Secret blind index not found" + throw new BadRequestError({ + message: "Missing secret blind index" }); } return { secretBlindIndex }; @@ -762,8 +762,8 @@ export const secretApprovalRequestServiceFactory = ({ secretQueueService, inputSecrets: secretDeletionCommits.map(({ secretBlindIndex }) => { if (!secretBlindIndex) { - throw new NotFoundError({ - message: "Secret blind index not found" + throw new BadRequestError({ + message: "Missing secret blind index" }); } return { secretBlindIndex, type: SecretType.Shared }; @@ -789,7 +789,7 @@ export const secretApprovalRequestServiceFactory = ({ await snapshotService.performSnapshot(folderId); const [folder] = await folderDAL.findSecretPathByFolderIds(projectId, [folderId]); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); await secretQueueService.syncSecrets({ projectId, secretPath: folder.path, @@ -860,14 +860,14 @@ export const secretApprovalRequestServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "GenSecretApproval" }); const folderId = folder.id; const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Update secret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" }); const commits: Omit[] = []; const commitTagIds: Record = {}; @@ -961,7 +961,7 @@ export const secretApprovalRequestServiceFactory = ({ secretDAL }); const secretsGroupedByBlindIndex = groupBy(secrets, (i) => { - if (!i.secretBlindIndex) throw new NotFoundError({ message: "Secret blind index not found" }); + if (!i.secretBlindIndex) throw new BadRequestError({ message: "Missing secret blind index" }); return i.secretBlindIndex; }); const deletedSecretIds = deletedSecrets.map( @@ -972,7 +972,7 @@ export const secretApprovalRequestServiceFactory = ({ ...deletedSecrets.map((el) => { const secretId = secretsGroupedByBlindIndex[keyName2BlindIndex[el.secretName]][0].id; if (!latestSecretVersions[secretId].secretBlindIndex) - throw new NotFoundError({ message: "Secret blind index not found" }); + throw new BadRequestError({ message: "Failed to find secret blind index" }); return { op: SecretOperations.Delete as const, ...latestSecretVersions[secretId], @@ -988,7 +988,7 @@ export const secretApprovalRequestServiceFactory = ({ const tagIds = unique(Object.values(commitTagIds).flat()); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const secretApprovalRequest = await secretApprovalRequestDAL.transaction(async (tx) => { const doc = await secretApprovalRequestDAL.create( @@ -1054,7 +1054,7 @@ export const secretApprovalRequestServiceFactory = ({ const commitsGroupByBlindIndex = groupBy(approvalCommits, (i) => { if (!i.secretBlindIndex) { - throw new NotFoundError({ message: "Secret blind index not found" }); + throw new BadRequestError({ message: "Missing secret blind index" }); } return i.secretBlindIndex; }); @@ -1132,7 +1132,7 @@ export const secretApprovalRequestServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "GenSecretApproval" }); @@ -1191,8 +1191,8 @@ export const secretApprovalRequestServiceFactory = ({ })) ); if (secretsToUpdateStoredInDB.length !== secretsToUpdate.length) - throw new NotFoundError({ - message: `Secret does not exist: ${secretsToUpdateStoredInDB.map((el) => el.key).join(",")}` + throw new BadRequestError({ + message: `Secret not exist: ${secretsToUpdateStoredInDB.map((el) => el.key).join(",")}` }); // now find any secret that needs to update its name @@ -1207,8 +1207,8 @@ export const secretApprovalRequestServiceFactory = ({ })) ); if (secrets.length) - throw new NotFoundError({ - message: `Secret does not exist: ${secretsToUpdateStoredInDB.map((el) => el.key).join(",")}` + throw new BadRequestError({ + message: `Secret not exist: ${secretsToUpdateStoredInDB.map((el) => el.key).join(",")}` }); } @@ -1267,8 +1267,8 @@ export const secretApprovalRequestServiceFactory = ({ })) ); if (secretsToDeleteInDB.length !== deletedSecrets.length) - throw new NotFoundError({ - message: `Secret does not exist: ${secretsToDeleteInDB.map((el) => el.key).join(",")}` + throw new BadRequestError({ + message: `Secret not exist: ${secretsToDeleteInDB.map((el) => el.key).join(",")}` }); const secretsGroupedByKey = groupBy(secretsToDeleteInDB, (i) => i.key); const deletedSecretIds = deletedSecrets.map((el) => secretsGroupedByKey[el.secretKey][0].id); @@ -1291,7 +1291,7 @@ export const secretApprovalRequestServiceFactory = ({ const tagIds = unique(Object.values(commitTagIds).flat()); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const secretApprovalRequest = await secretApprovalRequestDAL.transaction(async (tx) => { const doc = await secretApprovalRequestDAL.create( diff --git a/backend/src/ee/services/secret-replication/secret-replication-service.ts b/backend/src/ee/services/secret-replication/secret-replication-service.ts index 8f74079f7..b77d6cbc2 100644 --- a/backend/src/ee/services/secret-replication/secret-replication-service.ts +++ b/backend/src/ee/services/secret-replication/secret-replication-service.ts @@ -4,7 +4,7 @@ import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approv import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal"; import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { groupBy, unique } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; @@ -295,7 +295,7 @@ export const secretReplicationServiceFactory = ({ const [destinationFolder] = await folderDAL.findSecretPathByFolderIds(projectId, [ destinationSecretImport.folderId ]); - if (!destinationFolder) throw new NotFoundError({ message: "Imported folder not found" }); + if (!destinationFolder) throw new BadRequestError({ message: "Imported folder not found" }); let destinationReplicationFolder = await folderDAL.findOne({ parentId: destinationFolder.id, @@ -506,7 +506,7 @@ export const secretReplicationServiceFactory = ({ return; } - if (!botKey) throw new NotFoundError({ message: "Project bot not found" }); + if (!botKey) throw new BadRequestError({ message: "Bot not found" }); // these are the secrets to be added in replicated folders const sourceLocalSecrets = await secretDAL.find({ folderId: folder.id, type: SecretType.Shared }); const sourceSecretImports = await secretImportDAL.find({ folderId: folder.id }); @@ -545,7 +545,7 @@ export const secretReplicationServiceFactory = ({ const [destinationFolder] = await folderDAL.findSecretPathByFolderIds(projectId, [ destinationSecretImport.folderId ]); - if (!destinationFolder) throw new NotFoundError({ message: "Imported folder not found" }); + if (!destinationFolder) throw new BadRequestError({ message: "Imported folder not found" }); let destinationReplicationFolder = await folderDAL.findOne({ parentId: destinationFolder.id, diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts index 76743ecdb..ab419e4c9 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts @@ -13,7 +13,7 @@ import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; import { daysToMillisecond, secondsToMillis } from "@app/lib/dates"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue"; @@ -332,7 +332,7 @@ export const secretRotationQueueFactory = ({ ); }); } else { - if (!botKey) throw new NotFoundError({ message: "Project bot not found" }); + if (!botKey) throw new BadRequestError({ message: "Bot not found" }); const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({ secretId, value: encryptSymmetric128BitHexKeyUTF8( @@ -372,7 +372,7 @@ export const secretRotationQueueFactory = ({ ); await secretVersionDAL.insertMany( updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => { - if (!el.secretBlindIndex) throw new NotFoundError({ message: "Secret blind index not found" }); + if (!el.secretBlindIndex) throw new BadRequestError({ message: "Missing blind index" }); return { ...el, secretId: id, diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts b/backend/src/ee/services/secret-rotation/secret-rotation-service.ts index 8408463ef..d346c5bd3 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-service.ts @@ -3,7 +3,7 @@ import Ajv from "ajv"; import { ProjectVersion } from "@app/db/schemas"; import { decryptSymmetric128BitHexKeyUTF8, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectPermission } from "@app/lib/types"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; @@ -94,7 +94,7 @@ export const secretRotationServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); - if (!folder) throw new NotFoundError({ message: "Secret path not found" }); + if (!folder) throw new BadRequestError({ message: "Secret path not found" }); ForbiddenError.from(permission).throwUnlessCan( ProjectPermissionActions.Edit, subject(ProjectPermissionSub.Secrets, { environment, secretPath }) @@ -108,14 +108,14 @@ export const secretRotationServiceFactory = ({ $in: { id: Object.values(outputs) } }); if (selectedSecrets.length !== Object.values(outputs).length) - throw new NotFoundError({ message: "Secrets not found" }); + throw new BadRequestError({ message: "Secrets not found" }); } else { const selectedSecrets = await secretDAL.find({ folderId: folder.id, $in: { id: Object.values(outputs) } }); if (selectedSecrets.length !== Object.values(outputs).length) - throw new NotFoundError({ message: "Secrets not found" }); + throw new BadRequestError({ message: "Secrets not found" }); } const plan = await licenseService.getPlan(project.orgId); @@ -125,7 +125,7 @@ export const secretRotationServiceFactory = ({ }); const selectedTemplate = rotationTemplates.find(({ name }) => name === provider); - if (!selectedTemplate) throw new NotFoundError({ message: "Provider not found" }); + if (!selectedTemplate) throw new BadRequestError({ message: "Provider not found" }); const formattedInputs: Record = {}; Object.entries(inputs).forEach(([key, value]) => { const { type } = selectedTemplate.template.inputs.properties[key]; @@ -198,7 +198,7 @@ export const secretRotationServiceFactory = ({ return docs; } - if (!botKey) throw new NotFoundError({ message: "Project bot not found" }); + if (!botKey) throw new BadRequestError({ message: "bot not found" }); const docs = await secretRotationDAL.find({ projectId }); return docs.map((el) => ({ ...el, @@ -220,7 +220,7 @@ export const secretRotationServiceFactory = ({ const restartById = async ({ actor, actorId, actorOrgId, actorAuthMethod, rotationId }: TRestartDTO) => { const doc = await secretRotationDAL.findById(rotationId); - if (!doc) throw new NotFoundError({ message: "Rotation not found" }); + if (!doc) throw new BadRequestError({ message: "Rotation not found" }); const project = await projectDAL.findById(doc.projectId); const plan = await licenseService.getPlan(project.orgId); @@ -244,7 +244,7 @@ export const secretRotationServiceFactory = ({ const deleteById = async ({ actor, actorId, actorOrgId, actorAuthMethod, rotationId }: TDeleteDTO) => { const doc = await secretRotationDAL.findById(rotationId); - if (!doc) throw new NotFoundError({ message: "Rotation not found" }); + if (!doc) throw new BadRequestError({ message: "Rotation not found" }); const { permission } = await permissionService.getProjectPermission( actor, diff --git a/backend/src/ee/services/secret-scanning/secret-scanning-service.ts b/backend/src/ee/services/secret-scanning/secret-scanning-service.ts index 913972cd1..ef511deb8 100644 --- a/backend/src/ee/services/secret-scanning/secret-scanning-service.ts +++ b/backend/src/ee/services/secret-scanning/secret-scanning-service.ts @@ -7,7 +7,7 @@ import { ProbotOctokit } from "probot"; import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { getConfig } from "@app/lib/config/env"; -import { NotFoundError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { TGitAppDALFactory } from "./git-app-dal"; import { TGitAppInstallSessionDALFactory } from "./git-app-install-session-dal"; @@ -63,7 +63,7 @@ export const secretScanningServiceFactory = ({ actorOrgId }: TLinkInstallSessionDTO) => { const session = await gitAppInstallSessionDAL.findOne({ sessionId }); - if (!session) throw new NotFoundError({ message: "Session was not found" }); + if (!session) throw new UnauthorizedError({ message: "Session not found" }); const { permission } = await permissionService.getOrgPermission( actor, diff --git a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts index a1efb25ed..225339104 100644 --- a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts +++ b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts @@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability"; import { TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; -import { InternalServerError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, InternalServerError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; @@ -99,7 +99,7 @@ export const secretSnapshotServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); return snapshotDAL.countOfSnapshotsByFolderId(folder.id); }; @@ -131,7 +131,7 @@ export const secretSnapshotServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, path); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const snapshots = await snapshotDAL.find({ folderId: folder.id }, { limit, offset, sort: [["createdAt", "desc"]] }); return snapshots; @@ -139,7 +139,7 @@ export const secretSnapshotServiceFactory = ({ const getSnapshotData = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TGetSnapshotDataDTO) => { const snapshot = await snapshotDAL.findById(id); - if (!snapshot) throw new NotFoundError({ message: "Snapshot not found" }); + if (!snapshot) throw new BadRequestError({ message: "Snapshot not found" }); const { permission } = await permissionService.getProjectPermission( actor, actorId, @@ -173,7 +173,7 @@ export const secretSnapshotServiceFactory = ({ } else { const encryptedSnapshotDetails = await snapshotDAL.findSecretSnapshotDataById(id); const { botKey } = await projectBotService.getBotKey(snapshot.projectId); - if (!botKey) throw new NotFoundError({ message: "Project bot not found" }); + if (!botKey) throw new BadRequestError({ message: "bot not found" }); snapshotDetails = { ...encryptedSnapshotDetails, secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => ({ @@ -225,7 +225,7 @@ export const secretSnapshotServiceFactory = ({ try { if (!licenseService.isValidLicense) throw new InternalServerError({ message: "Invalid license" }); const folder = await folderDAL.findById(folderId); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); const shouldUseSecretV2Bridge = folder.projectVersion === 3; if (shouldUseSecretV2Bridge) { @@ -309,7 +309,7 @@ export const secretSnapshotServiceFactory = ({ actorOrgId }: TRollbackSnapshotDTO) => { const snapshot = await snapshotDAL.findById(snapshotId); - if (!snapshot) throw new NotFoundError({ message: "Snapshot not found" }); + if (!snapshot) throw new BadRequestError({ message: "Snapshot not found" }); const shouldUseBridge = snapshot.projectVersion === 3; const { permission } = await permissionService.getProjectPermission( diff --git a/backend/src/lib/errors/index.ts b/backend/src/lib/errors/index.ts index fd5631788..0a7cb8014 100644 --- a/backend/src/lib/errors/index.ts +++ b/backend/src/lib/errors/index.ts @@ -40,9 +40,9 @@ export class ForbiddenRequestError extends Error { error: unknown; - constructor({ name, error, message }: { message?: string; name?: string; error?: unknown } = {}) { + constructor({ name, error, message }: { message?: string; name?: string; error?: unknown }) { super(message ?? "You are not allowed to access this resource"); - this.name = name || "ForbiddenError"; + this.name = name || "ForbideenError"; this.error = error; } } diff --git a/backend/src/lib/ip/index.ts b/backend/src/lib/ip/index.ts index 6503165f6..30f710d19 100644 --- a/backend/src/lib/ip/index.ts +++ b/backend/src/lib/ip/index.ts @@ -1,6 +1,6 @@ import net from "node:net"; -import { ForbiddenRequestError } from "../errors"; +import { UnauthorizedError } from "../errors"; export enum IPType { IPV4 = "ipv4", @@ -126,7 +126,7 @@ export const checkIPAgainstBlocklist = ({ ipAddress, trustedIps }: { ipAddress: const check = blockList.check(ipAddress, type); if (!check) - throw new ForbiddenRequestError({ - message: "You are not allowed to access this resource from the current IP address" + throw new UnauthorizedError({ + message: "Failed to authenticate" }); }; diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index 8456eed8d..726f8431c 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -20,7 +20,6 @@ import { TQueueServiceFactory } from "@app/queue"; import { TSmtpService } from "@app/services/smtp/smtp-service"; import { globalRateLimiterCfg } from "./config/rateLimiter"; -import { addErrorsToResponseSchemas } from "./plugins/add-errors-to-response-schemas"; import { fastifyErrHandler } from "./plugins/error-handler"; import { registerExternalNextjs } from "./plugins/external-nextjs"; import { serializerCompiler, validatorCompiler, ZodTypeProvider } from "./plugins/fastify-zod"; @@ -76,8 +75,6 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { credentials: true, origin: appCfg.SITE_URL || true }); - - await server.register(addErrorsToResponseSchemas); // pull ip based on various proxy headers await server.register(fastifyIp); diff --git a/backend/src/server/plugins/add-errors-to-response-schemas.ts b/backend/src/server/plugins/add-errors-to-response-schemas.ts deleted file mode 100644 index 75844040c..000000000 --- a/backend/src/server/plugins/add-errors-to-response-schemas.ts +++ /dev/null @@ -1,15 +0,0 @@ -/* eslint-disable no-param-reassign */ -import fp from "fastify-plugin"; - -import { DefaultResponseErrorsSchema } from "../routes/sanitizedSchemas"; - -export const addErrorsToResponseSchemas = fp(async (server) => { - server.addHook("onRoute", (routeOptions) => { - if (routeOptions.schema && routeOptions.schema.response) { - routeOptions.schema.response = { - ...DefaultResponseErrorsSchema, - ...routeOptions.schema.response - }; - } - }); -}); diff --git a/backend/src/server/plugins/audit-log.ts b/backend/src/server/plugins/audit-log.ts index 3f49778e8..084b0cb54 100644 --- a/backend/src/server/plugins/audit-log.ts +++ b/backend/src/server/plugins/audit-log.ts @@ -70,7 +70,7 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => { metadata: {} }; } else { - throw new BadRequestError({ message: "Invalid actor type provided" }); + throw new BadRequestError({ message: "Missing logic for other actor" }); } req.auditLogInfo = payload; }); diff --git a/backend/src/server/plugins/auth/inject-identity.ts b/backend/src/server/plugins/auth/inject-identity.ts index 1cc863168..41a9e65d8 100644 --- a/backend/src/server/plugins/auth/inject-identity.ts +++ b/backend/src/server/plugins/auth/inject-identity.ts @@ -5,7 +5,7 @@ import jwt, { JwtPayload } from "jsonwebtoken"; import { TServiceTokens, TUsers } from "@app/db/schemas"; import { TScimTokenJwtPayload } from "@app/ee/services/scim/scim-types"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { ActorType, AuthMethod, AuthMode, AuthModeJwtTokenPayload, AuthTokenType } from "@app/services/auth/auth-type"; import { TIdentityAccessTokenJwtPayload } from "@app/services/identity-access-token/identity-access-token-types"; @@ -167,7 +167,7 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => { break; } default: - throw new BadRequestError({ message: "Invalid token strategy provided" }); + throw new UnauthorizedError({ name: "Unknown token strategy" }); } }); }); diff --git a/backend/src/server/plugins/auth/superAdmin.ts b/backend/src/server/plugins/auth/superAdmin.ts index f5868f130..d5dee581b 100644 --- a/backend/src/server/plugins/auth/superAdmin.ts +++ b/backend/src/server/plugins/auth/superAdmin.ts @@ -1,6 +1,6 @@ import { FastifyReply, FastifyRequest, HookHandlerDoneFunction } from "fastify"; -import { ForbiddenRequestError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { ActorType } from "@app/services/auth/auth-type"; export const verifySuperAdmin = ( @@ -9,8 +9,9 @@ export const verifySuperAdmin = ( done: HookHandlerDoneFunction ) => { if (req.auth.actor !== ActorType.USER || !req.auth.user.superAdmin) - throw new ForbiddenRequestError({ - message: "Requires elevated super admin privileges" + throw new UnauthorizedError({ + name: "Unauthorized access", + message: "Requires superadmin access" }); done(); }; diff --git a/backend/src/server/plugins/auth/verify-auth.ts b/backend/src/server/plugins/auth/verify-auth.ts index 44ea069dc..3b3a239f7 100644 --- a/backend/src/server/plugins/auth/verify-auth.ts +++ b/backend/src/server/plugins/auth/verify-auth.ts @@ -1,6 +1,6 @@ import { FastifyReply, FastifyRequest, HookHandlerDoneFunction } from "fastify"; -import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { AuthMode } from "@app/services/auth/auth-type"; interface TAuthOptions { @@ -11,11 +11,11 @@ export const verifyAuth = (authStrategies: AuthMode[], options: TAuthOptions = { requireOrg: true }) => (req: T, _res: FastifyReply, done: HookHandlerDoneFunction) => { if (!Array.isArray(authStrategies)) throw new Error("Auth strategy must be array"); - if (!req.auth) throw new UnauthorizedError({ message: "Token missing" }); + if (!req.auth) throw new UnauthorizedError({ name: "Unauthorized access", message: "Token missing" }); const isAccessAllowed = authStrategies.some((strategy) => strategy === req.auth.authMode); if (!isAccessAllowed) { - throw new ForbiddenRequestError({ name: `Forbidden access to ${req.url}` }); + throw new UnauthorizedError({ name: `${req.url} Unauthorized Access` }); } // New optional option. There are some routes which do not require an organization ID to be present on the request. diff --git a/backend/src/server/plugins/error-handler.ts b/backend/src/server/plugins/error-handler.ts index ee57a080d..1aa2c0a44 100644 --- a/backend/src/server/plugins/error-handler.ts +++ b/backend/src/server/plugins/error-handler.ts @@ -6,7 +6,6 @@ import { ZodError } from "zod"; import { BadRequestError, DatabaseError, - ForbiddenRequestError, InternalServerError, NotFoundError, ScimRequestError, @@ -27,23 +26,17 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider } else if (error instanceof NotFoundError) { void res.status(404).send({ statusCode: 404, message: error.message, error: error.name }); } else if (error instanceof UnauthorizedError) { - void res.status(401).send({ statusCode: 401, message: error.message, error: error.name }); + void res.status(403).send({ statusCode: 403, message: error.message, error: error.name }); } else if (error instanceof DatabaseError || error instanceof InternalServerError) { void res.status(500).send({ statusCode: 500, message: "Something went wrong", error: error.name }); } else if (error instanceof ZodError) { - void res.status(401).send({ statusCode: 401, error: "ValidationFailure", message: error.issues }); + void res.status(403).send({ statusCode: 403, error: "ValidationFailure", message: error.issues }); } else if (error instanceof ForbiddenError) { - void res.status(403).send({ - statusCode: 403, + void res.status(401).send({ + statusCode: 401, error: "PermissionDenied", message: `You are not allowed to ${error.action} on ${error.subjectType}` }); - } else if (error instanceof ForbiddenRequestError) { - void res.status(403).send({ - statusCode: 403, - message: error.message, - error: error.name - }); } else if (error instanceof ScimRequestError) { void res.status(error.status).send({ schemas: error.schemas, @@ -66,8 +59,8 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider return error.message; })(); - void res.status(403).send({ - statusCode: 403, + void res.status(401).send({ + statusCode: 401, error: "TokenError", message }); diff --git a/backend/src/server/routes/sanitizedSchemas.ts b/backend/src/server/routes/sanitizedSchemas.ts index 54dc9515c..02d9e37e0 100644 --- a/backend/src/server/routes/sanitizedSchemas.ts +++ b/backend/src/server/routes/sanitizedSchemas.ts @@ -27,34 +27,6 @@ export const integrationAuthPubSchema = IntegrationAuthsSchema.pick({ updatedAt: true }); -export const DefaultResponseErrorsSchema = { - 400: z.object({ - statusCode: z.literal(400), - message: z.string(), - error: z.string() - }), - 404: z.object({ - statusCode: z.literal(404), - message: z.string(), - error: z.string() - }), - 401: z.object({ - statusCode: z.literal(401), - message: z.string(), - error: z.string() - }), - 403: z.object({ - statusCode: z.literal(403), - message: z.any(), - error: z.string() - }), - 500: z.object({ - statusCode: z.literal(500), - message: z.string(), - error: z.string() - }) -}; - export const sapPubSchema = SecretApprovalPoliciesSchema.merge( z.object({ environment: z.object({ diff --git a/backend/src/server/routes/v1/admin-router.ts b/backend/src/server/routes/v1/admin-router.ts index 9a3480288..e476a53f9 100644 --- a/backend/src/server/routes/v1/admin-router.ts +++ b/backend/src/server/routes/v1/admin-router.ts @@ -2,7 +2,7 @@ import { z } from "zod"; import { OrganizationsSchema, SuperAdminSchema, UsersSchema } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; @@ -227,7 +227,8 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => { handler: async (req, res) => { const appCfg = getConfig(); const serverCfg = await getServerCfg(); - if (serverCfg.initialized) throw new BadRequestError({ message: "Admin account has already been set up" }); + if (serverCfg.initialized) + throw new UnauthorizedError({ name: "Admin sign up", message: "Admin has been created" }); const { user, token, organization } = await server.services.superAdmin.adminSignUp({ ...req.body, ip: req.realIp, diff --git a/backend/src/server/routes/v1/auth-router.ts b/backend/src/server/routes/v1/auth-router.ts index 61bc910a6..7f09a904b 100644 --- a/backend/src/server/routes/v1/auth-router.ts +++ b/backend/src/server/routes/v1/auth-router.ts @@ -2,7 +2,7 @@ import jwt from "jsonwebtoken"; import { z } from "zod"; import { getConfig } from "@app/lib/config/env"; -import { NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { authRateLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode, AuthModeRefreshJwtTokenPayload, AuthTokenType } from "@app/services/auth/auth-type"; @@ -71,34 +71,23 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => { const refreshToken = req.cookies.jid; const appCfg = getConfig(); if (!refreshToken) - throw new NotFoundError({ - name: "AuthTokenNotFound", - message: "Failed to find refresh token" + throw new BadRequestError({ + name: "Auth token route", + message: "Failed to find refresh token" }); const decodedToken = jwt.verify(refreshToken, appCfg.AUTH_SECRET) as AuthModeRefreshJwtTokenPayload; if (decodedToken.authTokenType !== AuthTokenType.REFRESH_TOKEN) - throw new UnauthorizedError({ - message: "The token provided is not a refresh token", - name: "InvalidToken" - }); + throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" }); const tokenVersion = await server.services.authToken.getUserTokenSessionById( decodedToken.tokenVersionId, decodedToken.userId ); - if (!tokenVersion) - throw new UnauthorizedError({ - message: "Valid token version not found", - name: "InvalidToken" - }); + if (!tokenVersion) throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" }); - if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) { - throw new UnauthorizedError({ - message: "Token version mismatch", - name: "InvalidToken" - }); - } + if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) + throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" }); const token = jwt.sign( { diff --git a/backend/src/server/routes/v1/identity-azure-auth-router.ts b/backend/src/server/routes/v1/identity-azure-auth-router.ts index 7526d097b..589f9e92c 100644 --- a/backend/src/server/routes/v1/identity-azure-auth-router.ts +++ b/backend/src/server/routes/v1/identity-azure-auth-router.ts @@ -9,8 +9,6 @@ import { AuthMode } from "@app/services/auth/auth-type"; import { TIdentityTrustedIp } from "@app/services/identity/identity-types"; import { validateAzureAuthField } from "@app/services/identity-azure-auth/identity-azure-auth-validators"; -import {} from "../sanitizedSchemas"; - export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider) => { server.route({ method: "POST", diff --git a/backend/src/server/routes/v1/integration-router.ts b/backend/src/server/routes/v1/integration-router.ts index 202b5cf8c..f08bb7e3b 100644 --- a/backend/src/server/routes/v1/integration-router.ts +++ b/backend/src/server/routes/v1/integration-router.ts @@ -11,8 +11,6 @@ import { AuthMode } from "@app/services/auth/auth-type"; import { IntegrationMetadataSchema } from "@app/services/integration/integration-schema"; import { PostHogEventTypes, TIntegrationCreatedEvent } from "@app/services/telemetry/telemetry-types"; -import {} from "../sanitizedSchemas"; - export const registerIntegrationRouter = async (server: FastifyZodProvider) => { server.route({ method: "POST", diff --git a/backend/src/server/routes/v1/sso-router.ts b/backend/src/server/routes/v1/sso-router.ts index 18c8595af..cea67999c 100644 --- a/backend/src/server/routes/v1/sso-router.ts +++ b/backend/src/server/routes/v1/sso-router.ts @@ -14,7 +14,7 @@ import { Strategy as GoogleStrategy } from "passport-google-oauth20"; import { z } from "zod"; import { getConfig } from "@app/lib/config/env"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { fetchGithubEmails } from "@app/lib/requests/github"; import { AuthMethod } from "@app/services/auth/auth-type"; @@ -42,9 +42,9 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => { try { const email = profile?.emails?.[0]?.value; if (!email) - throw new NotFoundError({ + throw new BadRequestError({ message: "Email not found", - name: "OauthGoogleRegister" + name: "Oauth Google Register" }); const { isUserCompleted, providerAuthToken } = await server.services.login.oauth2Login({ diff --git a/backend/src/server/routes/v2/organization-router.ts b/backend/src/server/routes/v2/organization-router.ts index d237bca22..e6ea094c3 100644 --- a/backend/src/server/routes/v2/organization-router.ts +++ b/backend/src/server/routes/v2/organization-router.ts @@ -69,7 +69,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { rateLimit: readLimit }, schema: { - description: "Return projects in organization that user is apart of", + description: "Return projects in organization that user is part of", security: [ { bearerAuth: [] diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index e0341cc78..7a1868fef 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -10,7 +10,7 @@ import { } from "@app/db/schemas"; import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types"; import { RAW_SECRETS, SECRETS } from "@app/lib/api-docs"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { removeTrailingSlash } from "@app/lib/fn"; import { secretsLimit, writeLimit } from "@app/server/config/rateLimiter"; import { getTelemetryDistinctId } from "@app/server/lib/telemetry"; @@ -240,7 +240,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId }); - if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.query.workspaceSlug}` }); + if (!workspace) throw new BadRequestError({ message: `No project found with slug ${req.query.workspaceSlug}` }); workspaceId = workspace.id; } diff --git a/backend/src/server/routes/v3/signup-router.ts b/backend/src/server/routes/v3/signup-router.ts index d801e85ef..2b603f523 100644 --- a/backend/src/server/routes/v3/signup-router.ts +++ b/backend/src/server/routes/v3/signup-router.ts @@ -2,7 +2,7 @@ import { z } from "zod"; import { UsersSchema } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; -import { ForbiddenRequestError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { authRateLimit } from "@app/server/config/rateLimiter"; import { getServerCfg } from "@app/services/super-admin/super-admin-service"; import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types"; @@ -29,8 +29,8 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => { const serverCfg = await getServerCfg(); if (!serverCfg.allowSignUp) { - throw new ForbiddenRequestError({ - message: "Signup's are disabled" + throw new BadRequestError({ + message: "Sign up is disabled" }); } @@ -38,7 +38,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => { const domain = email.split("@")[1]; const allowedDomains = serverCfg.allowedSignUpDomain.split(",").map((e) => e.trim()); if (!allowedDomains.includes(domain)) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: `Email with a domain (@${domain}) is not supported` }); } @@ -70,13 +70,13 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => { handler: async (req) => { const serverCfg = await getServerCfg(); if (!serverCfg.allowSignUp) { - throw new ForbiddenRequestError({ - message: "Signup's are disabled" + throw new BadRequestError({ + message: "Sign up is disabled" }); } const { token, user } = await server.services.signup.verifyEmailSignup(req.body.email, req.body.code); - return { message: "Successfully verified email", token, user }; + return { message: "Successfuly verified email", token, user }; } }); @@ -121,8 +121,8 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => { const serverCfg = await getServerCfg(); if (!serverCfg.allowSignUp) { - throw new ForbiddenRequestError({ - message: "Signup's are disabled" + throw new BadRequestError({ + message: "Sign up is disabled" }); } diff --git a/backend/src/services/api-key/api-key-service.ts b/backend/src/services/api-key/api-key-service.ts index df69372b5..39ccbecce 100644 --- a/backend/src/services/api-key/api-key-service.ts +++ b/backend/src/services/api-key/api-key-service.ts @@ -4,7 +4,7 @@ import bcrypt from "bcrypt"; import { TApiKeys } from "@app/db/schemas/api-keys"; import { getConfig } from "@app/lib/config/env"; -import { NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { TUserDALFactory } from "../user/user-dal"; import { TApiKeyDALFactory } from "./api-key-dal"; @@ -45,7 +45,7 @@ export const apiKeyServiceFactory = ({ apiKeyDAL, userDAL }: TApiKeyServiceFacto const deleteApiKey = async (userId: string, apiKeyId: string) => { const [apiKeyData] = await apiKeyDAL.delete({ id: apiKeyId, userId }); - if (!apiKeyData) throw new NotFoundError({ message: "API key not found" }); + if (!apiKeyData) throw new BadRequestError({ message: "Failed to find api key", name: "delete api key" }); return formatApiKey(apiKeyData); }; diff --git a/backend/src/services/auth-token/auth-token-service.ts b/backend/src/services/auth-token/auth-token-service.ts index 28302052e..3610bcded 100644 --- a/backend/src/services/auth-token/auth-token-service.ts +++ b/backend/src/services/auth-token/auth-token-service.ts @@ -4,7 +4,7 @@ import bcrypt from "bcrypt"; import { TAuthTokens, TAuthTokenSessions } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; -import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal"; import { AuthModeJwtTokenPayload } from "../auth/auth-type"; @@ -150,13 +150,11 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, orgMembershipDAL }: TAu id: token.tokenVersionId, userId: token.userId }); - if (!session) throw new NotFoundError({ name: "Session not found" }); - if (token.accessVersion !== session.accessVersion) { - throw new UnauthorizedError({ name: "StaleSession", message: "User session is stale, please re-authenticate" }); - } + if (!session) throw new UnauthorizedError({ name: "Session not found" }); + if (token.accessVersion !== session.accessVersion) throw new UnauthorizedError({ name: "Stale session" }); const user = await userDAL.findById(session.userId); - if (!user || !user.isAccepted) throw new NotFoundError({ message: "User not found" }); + if (!user || !user.isAccepted) throw new UnauthorizedError({ name: "Token user not found" }); if (token.organizationId) { const orgMembership = await orgMembershipDAL.findOne({ @@ -164,12 +162,8 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, orgMembershipDAL }: TAu orgId: token.organizationId }); - if (!orgMembership) { - throw new ForbiddenRequestError({ message: "User not member of organization" }); - } - if (!orgMembership.isActive) { - throw new ForbiddenRequestError({ message: "User organization membership is inactive" }); - } + if (!orgMembership) throw new ForbiddenRequestError({ message: "User not member of organization" }); + if (!orgMembership.isActive) throw new ForbiddenRequestError({ message: "User not active in organization" }); } return { user, tokenVersionId: token.tokenVersionId, orgId: token.organizationId }; diff --git a/backend/src/services/auth/auth-fns.ts b/backend/src/services/auth/auth-fns.ts index 5f7aca812..e8574a8b9 100644 --- a/backend/src/services/auth/auth-fns.ts +++ b/backend/src/services/auth/auth-fns.ts @@ -1,7 +1,7 @@ import jwt from "jsonwebtoken"; import { getConfig } from "@app/lib/config/env"; -import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { AuthModeProviderJwtTokenPayload, AuthModeProviderSignUpTokenPayload, AuthTokenType } from "./auth-type"; @@ -25,15 +25,15 @@ export const validateSignUpAuthorization = (token: string, userId: string, valid const appCfg = getConfig(); const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>token?.split(" ", 2) ?? [null, null]; if (AUTH_TOKEN_TYPE === null) { - throw new UnauthorizedError({ message: "Missing Authorization Header in the request header." }); + throw new BadRequestError({ message: "Missing Authorization Header in the request header." }); } if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") { - throw new UnauthorizedError({ + throw new BadRequestError({ message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.` }); } if (AUTH_TOKEN_VALUE === null) { - throw new UnauthorizedError({ + throw new BadRequestError({ message: "Missing Authorization Body in the request header" }); } @@ -47,8 +47,8 @@ export const validateSignUpAuthorization = (token: string, userId: string, valid export const enforceUserLockStatus = (isLocked: boolean, temporaryLockDateEnd?: Date | null) => { if (isLocked) { - throw new ForbiddenRequestError({ - name: "UserLocked", + throw new UnauthorizedError({ + name: "User Locked", message: "User is locked due to multiple failed login attempts. An email has been sent to you in order to unlock your account. You can also reset your password to unlock your account." }); @@ -61,8 +61,8 @@ export const enforceUserLockStatus = (isLocked: boolean, temporaryLockDateEnd?: const timeDisplay = secondsDiff > 60 ? `${Math.ceil(secondsDiff / 60)} minutes` : `${Math.ceil(secondsDiff)} seconds`; - throw new ForbiddenRequestError({ - name: "UserLocked", + throw new UnauthorizedError({ + name: "User Locked", message: `User is temporary locked due to multiple failed login attempts. Try again after ${timeDisplay}. You can also reset your password now to proceed.` }); } diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts index a80f0bc85..fb38c024e 100644 --- a/backend/src/services/auth/auth-login-service.ts +++ b/backend/src/services/auth/auth-login-service.ts @@ -8,7 +8,7 @@ import { request } from "@app/lib/config/request"; import { generateSrpServerKey, srpCheckClientProof } from "@app/lib/crypto"; import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; import { getUserPrivateKey } from "@app/lib/crypto/srp"; -import { BadRequestError, DatabaseError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, DatabaseError, UnauthorizedError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { getServerCfg } from "@app/services/super-admin/super-admin-service"; @@ -350,7 +350,7 @@ export const authLoginServiceFactory = ({ const cfg = getConfig(); if (!authJwtToken) throw new UnauthorizedError({ name: "Authorization header is required" }); - if (!userAgent) throw new UnauthorizedError({ name: "User-Agent header is required" }); + if (!userAgent) throw new UnauthorizedError({ name: "user agent header is required" }); // eslint-disable-next-line no-param-reassign authJwtToken = authJwtToken.replace("Bearer ", ""); // remove bearer from token @@ -368,7 +368,7 @@ export const authLoginServiceFactory = ({ const selectedOrg = await orgDAL.findById(organizationId); if (!hasOrganizationMembership) { - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: `User does not have access to the organization named ${selectedOrg?.name}` }); } diff --git a/backend/src/services/auth/auth-signup-service.ts b/backend/src/services/auth/auth-signup-service.ts index b55d01308..11c4bc61e 100644 --- a/backend/src/services/auth/auth-signup-service.ts +++ b/backend/src/services/auth/auth-signup-service.ts @@ -9,7 +9,7 @@ import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns"; import { getConfig } from "@app/lib/config/env"; import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; import { generateUserSrpKeys, getUserPrivateKey } from "@app/lib/crypto/srp"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { isDisposableEmail } from "@app/lib/validator"; import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; @@ -380,7 +380,7 @@ export const authSignupServiceFactory = ({ status: OrgMembershipStatus.Invited }); if (!orgMembership) - throw new NotFoundError({ + throw new BadRequestError({ message: "Failed to find invitation for email", name: "complete account invite" }); diff --git a/backend/src/services/certificate-authority/certificate-authority-queue.ts b/backend/src/services/certificate-authority/certificate-authority-queue.ts index 5be67dea4..1d7021937 100644 --- a/backend/src/services/certificate-authority/certificate-authority-queue.ts +++ b/backend/src/services/certificate-authority/certificate-authority-queue.ts @@ -3,7 +3,7 @@ import crypto from "crypto"; import { getConfig } from "@app/lib/config/env"; import { daysToMillisecond, secondsToMillis } from "@app/lib/dates"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue"; import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; @@ -76,7 +76,7 @@ export const certificateAuthorityQueueFactory = ({ logger.info(`secretReminderQueue.process: [secretDocument=${caId}]`); const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id }); diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index 309a30fb0..c7d32f1d3 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -122,7 +122,7 @@ export const certificateAuthorityServiceFactory = ({ actorOrgId }: TCreateCaDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -290,7 +290,7 @@ export const certificateAuthorityServiceFactory = ({ */ const getCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -321,7 +321,7 @@ export const certificateAuthorityServiceFactory = ({ actorOrgId }: TUpdateCaDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -346,7 +346,7 @@ export const certificateAuthorityServiceFactory = ({ */ const deleteCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCaDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -371,7 +371,7 @@ export const certificateAuthorityServiceFactory = ({ */ const getCaCsr = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCsrDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -430,7 +430,7 @@ export const certificateAuthorityServiceFactory = ({ */ const renewCaCert = async ({ caId, notAfter, actorId, actorAuthMethod, actor, actorOrgId }: TRenewCaCertDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" }); @@ -702,7 +702,7 @@ export const certificateAuthorityServiceFactory = ({ const getCaCerts = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCertsDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -736,7 +736,7 @@ export const certificateAuthorityServiceFactory = ({ */ const getCaCert = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCertDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" }); const { permission } = await permissionService.getProjectPermission( @@ -817,7 +817,7 @@ export const certificateAuthorityServiceFactory = ({ }: TSignIntermediateDTO) => { const appCfg = getConfig(); const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -963,7 +963,7 @@ export const certificateAuthorityServiceFactory = ({ certificateChain }: TImportCertToCaDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1124,7 +1124,7 @@ export const certificateAuthorityServiceFactory = ({ } if (!ca) { - throw new NotFoundError({ message: "CA not found" }); + throw new BadRequestError({ message: "CA not found" }); } const { permission } = await permissionService.getProjectPermission( @@ -1451,7 +1451,7 @@ export const certificateAuthorityServiceFactory = ({ } if (!ca) { - throw new NotFoundError({ message: "CA not found" }); + throw new BadRequestError({ message: "CA not found" }); } if (!dto.isInternal) { @@ -1810,7 +1810,7 @@ export const certificateAuthorityServiceFactory = ({ actorOrgId }: TGetCaCertificateTemplatesDTO) => { const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new NotFoundError({ message: "CA not found" }); + if (!ca) throw new BadRequestError({ message: "CA not found" }); const { permission } = await permissionService.getProjectPermission( actor, diff --git a/backend/src/services/group-project/group-project-service.ts b/backend/src/services/group-project/group-project-service.ts index acd059f87..b204d3b48 100644 --- a/backend/src/services/group-project/group-project-service.ts +++ b/backend/src/services/group-project/group-project-service.ts @@ -66,7 +66,7 @@ export const groupProjectServiceFactory = ({ }: TCreateProjectGroupDTO) => { const project = await projectDAL.findById(projectId); - if (!project) throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` }); + if (!project) throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` }); if (project.version < 2) throw new BadRequestError({ message: `Failed to add group to E2EE project` }); const { permission } = await permissionService.getProjectPermission( @@ -79,7 +79,7 @@ export const groupProjectServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Groups); const group = await groupDAL.findOne({ orgId: actorOrgId, id: groupId }); - if (!group) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` }); + if (!group) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` }); const existingGroup = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id }); if (existingGroup) @@ -168,24 +168,24 @@ export const groupProjectServiceFactory = ({ const ghostUser = await projectDAL.findProjectGhostUser(project.id, tx); if (!ghostUser) { - throw new NotFoundError({ - message: "Failed to find project owner" + throw new BadRequestError({ + message: "Failed to find sudo user" }); } const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, project.id, tx); if (!ghostUserLatestKey) { - throw new NotFoundError({ - message: "Failed to find project owner's latest key" + throw new BadRequestError({ + message: "Failed to find sudo user latest key" }); } const bot = await projectBotDAL.findOne({ projectId: project.id }, tx); if (!bot) { - throw new NotFoundError({ - message: "Failed to find project bot" + throw new BadRequestError({ + message: "Failed to find bot" }); } @@ -235,7 +235,7 @@ export const groupProjectServiceFactory = ({ }: TUpdateProjectGroupDTO) => { const project = await projectDAL.findById(projectId); - if (!project) throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` }); + if (!project) throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` }); const { permission } = await permissionService.getProjectPermission( actor, @@ -247,10 +247,10 @@ export const groupProjectServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Groups); const group = await groupDAL.findOne({ orgId: actorOrgId, id: groupId }); - if (!group) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` }); + if (!group) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` }); const projectGroup = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id }); - if (!projectGroup) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` }); + if (!projectGroup) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` }); for await (const { role: requestedRoleChange } of roles) { const { permission: rolePermission } = await permissionService.getProjectPermissionByRole( @@ -331,13 +331,13 @@ export const groupProjectServiceFactory = ({ }: TDeleteProjectGroupDTO) => { const project = await projectDAL.findById(projectId); - if (!project) throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` }); + if (!project) throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` }); const group = await groupDAL.findOne({ orgId: actorOrgId, id: groupId }); - if (!group) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` }); + if (!group) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` }); const groupProjectMembership = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id }); - if (!groupProjectMembership) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` }); + if (!groupProjectMembership) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` }); const { permission } = await permissionService.getProjectPermission( actor, @@ -380,7 +380,7 @@ export const groupProjectServiceFactory = ({ const project = await projectDAL.findById(projectId); if (!project) { - throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` }); + throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` }); } const { permission } = await permissionService.getProjectPermission( diff --git a/backend/src/services/identity-access-token/identity-access-token-service.ts b/backend/src/services/identity-access-token/identity-access-token-service.ts index 4825773fb..13fd7b333 100644 --- a/backend/src/services/identity-access-token/identity-access-token-service.ts +++ b/backend/src/services/identity-access-token/identity-access-token-service.ts @@ -2,7 +2,7 @@ import jwt, { JwtPayload } from "jsonwebtoken"; import { TableName, TIdentityAccessTokens } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip"; import { TAccessTokenQueueServiceFactory } from "../access-token-queue/access-token-queue"; @@ -39,7 +39,7 @@ export const identityAccessTokenServiceFactory = ({ if (accessTokenNumUsesLimit > 0 && accessTokenNumUses > 0 && accessTokenNumUses >= accessTokenNumUsesLimit) { await identityAccessTokenDAL.deleteById(tokenId); - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "Unable to renew because access token number of uses limit reached" }); } @@ -55,7 +55,7 @@ export const identityAccessTokenServiceFactory = ({ if (currentDate > expirationDate) { await identityAccessTokenDAL.deleteById(tokenId); - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: "Failed to renew MI access token due to TTL expiration" }); } @@ -67,7 +67,7 @@ export const identityAccessTokenServiceFactory = ({ if (currentDate > expirationDate) { await identityAccessTokenDAL.deleteById(tokenId); - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: "Failed to renew MI access token due to TTL expiration" }); } @@ -81,15 +81,13 @@ export const identityAccessTokenServiceFactory = ({ const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload & { identityAccessTokenId: string; }; - if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) { - throw new ForbiddenRequestError({ message: "Only identity access tokens can be renewed" }); - } + if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) throw new UnauthorizedError(); const identityAccessToken = await identityAccessTokenDAL.findOne({ [`${TableName.IdentityAccessToken}.id` as "id"]: decodedToken.identityAccessTokenId, isAccessTokenRevoked: false }); - if (!identityAccessToken) throw new UnauthorizedError({ message: "No identity access token found" }); + if (!identityAccessToken) throw new UnauthorizedError(); let { accessTokenNumUses } = identityAccessToken; const tokenStatusInCache = await accessTokenQueue.getIdentityTokenDetailsInCache(identityAccessToken.id); @@ -109,7 +107,7 @@ export const identityAccessTokenServiceFactory = ({ if (currentDate > expirationDate) { await identityAccessTokenDAL.deleteById(identityAccessToken.id); - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: "Failed to renew MI access token due to Max TTL expiration" }); } @@ -117,7 +115,7 @@ export const identityAccessTokenServiceFactory = ({ const extendToDate = new Date(currentDate.getTime() + Number(accessTokenTTL * 1000)); if (extendToDate > expirationDate) { await identityAccessTokenDAL.deleteById(identityAccessToken.id); - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: "Failed to renew MI access token past its Max TTL expiration" }); } @@ -136,15 +134,13 @@ export const identityAccessTokenServiceFactory = ({ const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload & { identityAccessTokenId: string; }; - if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) { - throw new ForbiddenRequestError({ message: "Only identity access tokens can be revoked" }); - } + if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) throw new UnauthorizedError(); const identityAccessToken = await identityAccessTokenDAL.findOne({ [`${TableName.IdentityAccessToken}.id` as "id"]: decodedToken.identityAccessTokenId, isAccessTokenRevoked: false }); - if (!identityAccessToken) throw new UnauthorizedError({ message: "No identity access token found" }); + if (!identityAccessToken) throw new UnauthorizedError(); const revokedToken = await identityAccessTokenDAL.updateById(identityAccessToken.id, { isAccessTokenRevoked: true @@ -158,10 +154,10 @@ export const identityAccessTokenServiceFactory = ({ [`${TableName.IdentityAccessToken}.id` as "id"]: token.identityAccessTokenId, isAccessTokenRevoked: false }); - if (!identityAccessToken) throw new UnauthorizedError({ message: "No identity access token found" }); + if (!identityAccessToken) throw new UnauthorizedError(); if (identityAccessToken.isAccessTokenRevoked) - throw new ForbiddenRequestError({ - message: "Failed to authorize revoked access token, access token is revoked" + throw new UnauthorizedError({ + message: "Failed to authorize revoked access token" }); if (ipAddress && identityAccessToken) { @@ -176,7 +172,7 @@ export const identityAccessTokenServiceFactory = ({ }); if (!identityOrgMembership) { - throw new BadRequestError({ message: "Identity does not belong to any organization" }); + throw new UnauthorizedError({ message: "Identity does not belong to any organization" }); } let { accessTokenNumUses } = identityAccessToken; diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts index 620c1338b..ddbbe2039 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts @@ -9,7 +9,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; @@ -50,9 +50,7 @@ export const identityAwsAuthServiceFactory = ({ }: TIdentityAwsAuthServiceFactoryDep) => { const login = async ({ identityId, iamHttpRequestMethod, iamRequestBody, iamRequestHeaders }: TLoginAwsAuthDTO) => { const identityAwsAuth = await identityAwsAuthDAL.findOne({ identityId }); - if (!identityAwsAuth) { - throw new NotFoundError({ message: "AWS auth method not found for identity, did you configure AWS auth?" }); - } + if (!identityAwsAuth) throw new UnauthorizedError(); const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityAwsAuth.identityId }); @@ -154,7 +152,7 @@ export const identityAwsAuthServiceFactory = ({ actorOrgId }: TAttachAwsAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity.authMethod) throw new BadRequestError({ message: "Failed to add AWS Auth to already configured identity" @@ -233,7 +231,7 @@ export const identityAwsAuthServiceFactory = ({ actorOrgId }: TUpdateAwsAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH) throw new BadRequestError({ message: "Failed to update AWS Auth" @@ -292,7 +290,7 @@ export const identityAwsAuthServiceFactory = ({ const getAwsAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetAwsAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH) throw new BadRequestError({ message: "The identity does not have AWS Auth attached" @@ -319,7 +317,7 @@ export const identityAwsAuthServiceFactory = ({ actorOrgId }: TRevokeAwsAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH) throw new BadRequestError({ message: "The identity does not have aws auth" @@ -340,8 +338,8 @@ export const identityAwsAuthServiceFactory = ({ actorAuthMethod, actorOrgId ); - - if (!isAtLeastAsPrivileged(permission, rolePermission)) + const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission); + if (!hasPriviledge) throw new ForbiddenRequestError({ message: "Failed to revoke aws auth of identity with more privileged role" }); diff --git a/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts b/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts index 741d7e63c..7c89a35b9 100644 --- a/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts +++ b/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts @@ -24,7 +24,7 @@ export const validateAzureIdentity = async ({ const signingKeys = data.keys; const signingKey = signingKeys.find((key) => key.kid === kid); - if (!signingKey) throw new UnauthorizedError({ message: "Invalid signing key" }); + if (!signingKey) throw new UnauthorizedError(); const publicKey = `-----BEGIN CERTIFICATE-----\n${signingKey.x5c[0]}\n-----END CERTIFICATE-----`; diff --git a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts index f93eec2c2..0d52bf6a0 100644 --- a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts +++ b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts @@ -7,7 +7,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; @@ -49,12 +49,10 @@ export const identityAzureAuthServiceFactory = ({ }: TIdentityAzureAuthServiceFactoryDep) => { const login = async ({ identityId, jwt: azureJwt }: TLoginAzureAuthDTO) => { const identityAzureAuth = await identityAzureAuthDAL.findOne({ identityId }); - if (!identityAzureAuth) { - throw new NotFoundError({ message: "Azure auth method not found for identity, did you configure Azure Auth?" }); - } + if (!identityAzureAuth) throw new UnauthorizedError(); const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityAzureAuth.identityId }); - if (!identityMembershipOrg) throw new UnauthorizedError({ message: "Identity not attached to a organization" }); + if (!identityMembershipOrg) throw new UnauthorizedError(); const azureIdentity = await validateAzureIdentity({ tenantId: identityAzureAuth.tenantId, @@ -62,8 +60,7 @@ export const identityAzureAuthServiceFactory = ({ jwt: azureJwt }); - if (azureIdentity.tid !== identityAzureAuth.tenantId) - throw new UnauthorizedError({ message: "Tenant ID mismatch" }); + if (azureIdentity.tid !== identityAzureAuth.tenantId) throw new UnauthorizedError(); if (identityAzureAuth.allowedServicePrincipalIds) { // validate if the service principal id is in the list of allowed service principal ids @@ -73,7 +70,7 @@ export const identityAzureAuthServiceFactory = ({ .map((servicePrincipalId) => servicePrincipalId.trim()) .some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid); - if (!isServicePrincipalAllowed) throw new ForbiddenRequestError({ message: "Service principal not allowed" }); + if (!isServicePrincipalAllowed) throw new UnauthorizedError(); } const identityAccessToken = await identityAzureAuthDAL.transaction(async (tx) => { @@ -125,7 +122,7 @@ export const identityAzureAuthServiceFactory = ({ actorOrgId }: TAttachAzureAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity.authMethod) throw new BadRequestError({ message: "Failed to add Azure Auth to already configured identity" @@ -203,7 +200,7 @@ export const identityAzureAuthServiceFactory = ({ actorOrgId }: TUpdateAzureAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH) throw new BadRequestError({ message: "Failed to update Azure Auth" @@ -265,7 +262,7 @@ export const identityAzureAuthServiceFactory = ({ const getAzureAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetAzureAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH) throw new BadRequestError({ message: "The identity does not have Azure Auth attached" @@ -293,7 +290,7 @@ export const identityAzureAuthServiceFactory = ({ actorOrgId }: TRevokeAzureAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH) throw new BadRequestError({ message: "The identity does not have azure auth" diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts index 05567d190..e1afceada 100644 --- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts +++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts @@ -65,6 +65,6 @@ export const validateIamIdentity = async ({ algorithms: ["RS256"] }); - if (aud !== identityId) throw new UnauthorizedError({ message: "Invalid audience in GCP IAM Token" }); + if (aud !== identityId) throw new UnauthorizedError(); return { email: sub }; }; diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts index 2f666b821..fdbb8490d 100644 --- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts +++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts @@ -7,7 +7,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; @@ -47,14 +47,10 @@ export const identityGcpAuthServiceFactory = ({ }: TIdentityGcpAuthServiceFactoryDep) => { const login = async ({ identityId, jwt: gcpJwt }: TLoginGcpAuthDTO) => { const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId }); - if (!identityGcpAuth) { - throw new NotFoundError({ message: "GCP auth method not found for identity, did you configure GCP auth?" }); - } + if (!identityGcpAuth) throw new UnauthorizedError(); const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityGcpAuth.identityId }); - if (!identityMembershipOrg) { - throw new UnauthorizedError({ message: "Identity does not belong to any organization" }); - } + if (!identityMembershipOrg) throw new UnauthorizedError(); let gcpIdentityDetails: TGcpIdentityDetails; switch (identityGcpAuth.type) { @@ -167,7 +163,7 @@ export const identityGcpAuthServiceFactory = ({ actorOrgId }: TAttachGcpAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity.authMethod) throw new BadRequestError({ message: "Failed to add GCP Auth to already configured identity" @@ -247,7 +243,7 @@ export const identityGcpAuthServiceFactory = ({ actorOrgId }: TUpdateGcpAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH) throw new BadRequestError({ message: "Failed to update GCP Auth" @@ -310,7 +306,7 @@ export const identityGcpAuthServiceFactory = ({ const getGcpAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetGcpAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH) throw new BadRequestError({ message: "The identity does not have GCP Auth attached" @@ -338,7 +334,7 @@ export const identityGcpAuthServiceFactory = ({ actorOrgId }: TRevokeGcpAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH) throw new BadRequestError({ message: "The identity does not have gcp auth" diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts index 72f55b0e5..d0a1b07cf 100644 --- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts +++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts @@ -17,7 +17,7 @@ import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal"; @@ -63,19 +63,15 @@ export const identityKubernetesAuthServiceFactory = ({ }: TIdentityKubernetesAuthServiceFactoryDep) => { const login = async ({ identityId, jwt: serviceAccountJwt }: TLoginKubernetesAuthDTO) => { const identityKubernetesAuth = await identityKubernetesAuthDAL.findOne({ identityId }); - if (!identityKubernetesAuth) { - throw new NotFoundError({ - message: "Kubernetes auth method not found for identity, did you configure Kubernetes auth?" - }); - } + if (!identityKubernetesAuth) throw new UnauthorizedError(); const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityKubernetesAuth.identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Identity organization membership not found" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId }); - if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, @@ -131,8 +127,7 @@ export const identityKubernetesAuthServiceFactory = ({ if ("error" in data.status) throw new UnauthorizedError({ message: data.status.error }); // check the response to determine if the token is valid - if (!(data.status && data.status.authenticated)) - throw new ForbiddenRequestError({ message: "Kubernetes token not authenticated" }); + if (!(data.status && data.status.authenticated)) throw new UnauthorizedError(); const { namespace: targetNamespace, name: targetName } = extractK8sUsername(data.status.user.username); @@ -228,7 +223,7 @@ export const identityKubernetesAuthServiceFactory = ({ actorOrgId }: TAttachKubernetesAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity.authMethod) throw new BadRequestError({ message: "Failed to add Kubernetes Auth to already configured identity" @@ -372,7 +367,7 @@ export const identityKubernetesAuthServiceFactory = ({ actorOrgId }: TUpdateKubernetesAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH) throw new BadRequestError({ message: "Failed to update Kubernetes Auth" @@ -429,7 +424,7 @@ export const identityKubernetesAuthServiceFactory = ({ }; const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId }); - if (!orgBot) throw new NotFoundError({ message: "Org bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, @@ -496,7 +491,7 @@ export const identityKubernetesAuthServiceFactory = ({ actorOrgId }: TGetKubernetesAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH) throw new BadRequestError({ message: "The identity does not have Kubernetes Auth attached" @@ -514,7 +509,7 @@ export const identityKubernetesAuthServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Identity); const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId }); - if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); const key = infisicalSymmetricDecrypt({ ciphertext: orgBot.encryptedSymmetricKey, @@ -557,10 +552,10 @@ export const identityKubernetesAuthServiceFactory = ({ actorOrgId }: TRevokeKubernetesAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH) throw new BadRequestError({ - message: "The identity does not have kubernetes auth" + message: "The identity does not have kubenetes auth" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -578,9 +573,10 @@ export const identityKubernetesAuthServiceFactory = ({ actorAuthMethod, actorOrgId ); - if (!isAtLeastAsPrivileged(permission, rolePermission)) + const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission); + if (!hasPriviledge) throw new ForbiddenRequestError({ - message: "Failed to revoke kubernetes auth of identity with more privileged role" + message: "Failed to revoke kubenetes auth of identity with more privileged role" }); const revokedIdentityKubernetesAuth = await identityKubernetesAuthDAL.transaction(async (tx) => { diff --git a/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts b/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts index 1741074b5..a0feb824c 100644 --- a/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts +++ b/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts @@ -61,19 +61,19 @@ export const identityOidcAuthServiceFactory = ({ const login = async ({ identityId, jwt: oidcJwt }: TLoginOidcAuthDTO) => { const identityOidcAuth = await identityOidcAuthDAL.findOne({ identityId }); if (!identityOidcAuth) { - throw new NotFoundError({ message: "GCP auth method not found for identity, did you configure GCP auth?" }); + throw new UnauthorizedError(); } const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityOidcAuth.identityId }); if (!identityMembershipOrg) { - throw new NotFoundError({ message: "Identity organization membership not found" }); + throw new NotFoundError({ message: "Failed to find identity in organization" }); } const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId }); if (!orgBot) { - throw new NotFoundError({ message: "Organization bot was not found", name: "OrgBotNotFound" }); + throw new NotFoundError({ message: "Org bot not found", name: "OrgBotNotFound" }); } const key = infisicalSymmetricDecrypt({ @@ -136,7 +136,7 @@ export const identityOidcAuthServiceFactory = ({ if (identityOidcAuth.boundSubject) { if (!doesFieldValueMatchOidcPolicy(tokenData.sub, identityOidcAuth.boundSubject)) { - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: "Access denied: OIDC subject not allowed." }); } @@ -148,7 +148,7 @@ export const identityOidcAuthServiceFactory = ({ .split(", ") .some((policyValue) => doesFieldValueMatchOidcPolicy(tokenData.aud, policyValue)) ) { - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: "Access denied: OIDC audience not allowed." }); } @@ -161,7 +161,7 @@ export const identityOidcAuthServiceFactory = ({ if ( !claimValue.split(", ").some((claimEntry) => doesFieldValueMatchOidcPolicy(tokenData[claimKey], claimEntry)) ) { - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: "Access denied: OIDC claim not allowed." }); } @@ -221,7 +221,7 @@ export const identityOidcAuthServiceFactory = ({ }: TAttachOidcAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); if (!identityMembershipOrg) { - throw new NotFoundError({ message: "Failed to find identity" }); + throw new BadRequestError({ message: "Failed to find identity" }); } if (identityMembershipOrg.identity.authMethod) throw new BadRequestError({ @@ -360,7 +360,7 @@ export const identityOidcAuthServiceFactory = ({ }: TUpdateOidcAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); if (!identityMembershipOrg) { - throw new NotFoundError({ message: "Failed to find identity" }); + throw new BadRequestError({ message: "Failed to find identity" }); } if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) { @@ -422,7 +422,7 @@ export const identityOidcAuthServiceFactory = ({ const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId }); if (!orgBot) { - throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); } const key = infisicalSymmetricDecrypt({ @@ -460,7 +460,7 @@ export const identityOidcAuthServiceFactory = ({ const getOidcAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetOidcAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); if (!identityMembershipOrg) { - throw new NotFoundError({ message: "Failed to find identity" }); + throw new BadRequestError({ message: "Failed to find identity" }); } if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) { @@ -482,7 +482,7 @@ export const identityOidcAuthServiceFactory = ({ const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId }); if (!orgBot) { - throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" }); + throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" }); } const key = infisicalSymmetricDecrypt({ @@ -505,7 +505,7 @@ export const identityOidcAuthServiceFactory = ({ const revokeOidcAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TRevokeOidcAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); if (!identityMembershipOrg) { - throw new NotFoundError({ message: "Failed to find identity" }); + throw new BadRequestError({ message: "Failed to find identity" }); } if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) { diff --git a/backend/src/services/identity-project/identity-project-service.ts b/backend/src/services/identity-project/identity-project-service.ts index 13a319df9..4e48bf805 100644 --- a/backend/src/services/identity-project/identity-project-service.ts +++ b/backend/src/services/identity-project/identity-project-service.ts @@ -5,7 +5,7 @@ import { ProjectMembershipRole } from "@app/db/schemas"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { ActorType } from "../auth/auth-type"; @@ -75,7 +75,7 @@ export const identityProjectServiceFactory = ({ orgId: project.orgId }); if (!identityOrgMembership) - throw new NotFoundError({ + throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` }); @@ -103,8 +103,7 @@ export const identityProjectServiceFactory = ({ $in: { slug: customInputRoles.map(({ role }) => role) } }) : []; - if (customRoles.length !== customInputRoles.length) - throw new NotFoundError({ message: "Custom project roles not found" }); + if (customRoles.length !== customInputRoles.length) throw new BadRequestError({ message: "Custom role not found" }); const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug); const projectIdentity = await identityProjectDAL.transaction(async (tx) => { @@ -165,7 +164,7 @@ export const identityProjectServiceFactory = ({ const projectIdentity = await identityProjectDAL.findOne({ identityId, projectId }); if (!projectIdentity) - throw new NotFoundError({ + throw new BadRequestError({ message: `Identity with id ${identityId} doesn't exists in project with id ${projectId}` }); @@ -175,7 +174,9 @@ export const identityProjectServiceFactory = ({ projectId ); - if (!isAtLeastAsPrivileged(permission, rolePermission)) { + const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission); + + if (!hasRequiredPriviledges) { throw new ForbiddenRequestError({ message: "Failed to change to a more privileged role" }); } } @@ -191,8 +192,7 @@ export const identityProjectServiceFactory = ({ $in: { slug: customInputRoles.map(({ role }) => role) } }) : []; - if (customRoles.length !== customInputRoles.length) - throw new NotFoundError({ message: "Custom project roles not found" }); + if (customRoles.length !== customInputRoles.length) throw new BadRequestError({ message: "Custom role not found" }); const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug); @@ -238,7 +238,7 @@ export const identityProjectServiceFactory = ({ }: TDeleteProjectIdentityDTO) => { const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId }); if (!identityProjectMembership) - throw new NotFoundError({ message: `Failed to find identity with id ${identityId}` }); + throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` }); const { permission } = await permissionService.getProjectPermission( actor, @@ -255,7 +255,8 @@ export const identityProjectServiceFactory = ({ actorAuthMethod, actorOrgId ); - if (!isAtLeastAsPrivileged(permission, identityRolePermission)) + const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission); + if (!hasRequiredPriviledges) throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" }); const [deletedIdentity] = await identityProjectDAL.delete({ identityId, projectId }); @@ -314,7 +315,7 @@ export const identityProjectServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Identity); const [identityMembership] = await identityProjectDAL.findByProjectId(projectId, { identityId }); - if (!identityMembership) throw new NotFoundError({ message: `Membership not found for identity ${identityId}` }); + if (!identityMembership) throw new BadRequestError({ message: `Membership not found for identity ${identityId}` }); return identityMembership; }; diff --git a/backend/src/services/identity-token-auth/identity-token-auth-service.ts b/backend/src/services/identity-token-auth/identity-token-auth-service.ts index b6eacd0d7..198b76266 100644 --- a/backend/src/services/identity-token-auth/identity-token-auth-service.ts +++ b/backend/src/services/identity-token-auth/identity-token-auth-service.ts @@ -7,7 +7,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; @@ -64,7 +64,7 @@ export const identityTokenAuthServiceFactory = ({ actorOrgId }: TAttachTokenAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity.authMethod) throw new BadRequestError({ message: "Failed to add Token Auth to already configured identity" @@ -136,7 +136,7 @@ export const identityTokenAuthServiceFactory = ({ actorOrgId }: TUpdateTokenAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH) throw new BadRequestError({ message: "Failed to update Token Auth" @@ -196,7 +196,7 @@ export const identityTokenAuthServiceFactory = ({ const getTokenAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetTokenAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH) throw new BadRequestError({ message: "The identity does not have Token Auth attached" @@ -224,7 +224,7 @@ export const identityTokenAuthServiceFactory = ({ actorOrgId }: TRevokeTokenAuthDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH) throw new BadRequestError({ message: "The identity does not have Token Auth" @@ -245,12 +245,11 @@ export const identityTokenAuthServiceFactory = ({ actorAuthMethod, actorOrgId ); - - if (!isAtLeastAsPrivileged(permission, rolePermission)) { - throw new ForbiddenRequestError({ + const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission); + if (!hasPriviledge) + throw new UnauthorizedError({ message: "Failed to revoke Token Auth of identity with more privileged role" }); - } const revokedIdentityTokenAuth = await identityTokenAuthDAL.transaction(async (tx) => { const deletedTokenAuth = await identityTokenAuthDAL.delete({ identityId }, tx); @@ -269,7 +268,7 @@ export const identityTokenAuthServiceFactory = ({ name }: TCreateTokenAuthTokenDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH) throw new BadRequestError({ message: "The identity does not have Token Auth" @@ -343,7 +342,7 @@ export const identityTokenAuthServiceFactory = ({ actorOrgId }: TGetTokenAuthTokensDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH) throw new BadRequestError({ message: "The identity does not have Token Auth" @@ -378,7 +377,7 @@ export const identityTokenAuthServiceFactory = ({ const foundToken = await identityAccessTokenDAL.findById(tokenId); if (!foundToken) throw new NotFoundError({ message: "Failed to find token" }); const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: foundToken.identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH) throw new BadRequestError({ message: "The identity does not have Token Auth" @@ -439,7 +438,7 @@ export const identityTokenAuthServiceFactory = ({ }); if (!identityOrgMembership) { - throw new NotFoundError({ message: "No identity organization membership found" }); + throw new UnauthorizedError({ message: "Identity does not belong to any organization" }); } const { permission } = await permissionService.getOrgPermission( diff --git a/backend/src/services/identity-ua/identity-ua-service.ts b/backend/src/services/identity-ua/identity-ua-service.ts index b153d9e22..00dfa5d60 100644 --- a/backend/src/services/identity-ua/identity-ua-service.ts +++ b/backend/src/services/identity-ua/identity-ua-service.ts @@ -10,7 +10,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors"; import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip"; import { ActorType, AuthTokenType } from "../auth/auth-type"; @@ -54,11 +54,7 @@ export const identityUaServiceFactory = ({ }: TIdentityUaServiceFactoryDep) => { const login = async (clientId: string, clientSecret: string, ip: string) => { const identityUa = await identityUaDAL.findOne({ clientId }); - if (!identityUa) { - throw new NotFoundError({ - message: "No identity with specified client ID was found" - }); - } + if (!identityUa) throw new UnauthorizedError({ message: "Invalid credentials" }); const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityUa.identityId }); @@ -88,8 +84,8 @@ export const identityUaServiceFactory = ({ isClientSecretRevoked: true }); - throw new ForbiddenRequestError({ - message: "Access denied due to expired client secret" + throw new UnauthorizedError({ + message: "Failed to authenticate identity credentials due to expired client secret" }); } } @@ -100,8 +96,8 @@ export const identityUaServiceFactory = ({ await identityUaClientSecretDAL.updateById(validClientSecretInfo.id, { isClientSecretRevoked: true }); - throw new ForbiddenRequestError({ - message: "Access denied due to client secret usage limit reached" + throw new UnauthorizedError({ + message: "Failed to authenticate identity credentials due to client secret number of uses limit reached" }); } @@ -155,7 +151,7 @@ export const identityUaServiceFactory = ({ actorOrgId }: TAttachUaDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity.authMethod) throw new BadRequestError({ message: "Failed to add universal auth to already configured identity" @@ -246,7 +242,7 @@ export const identityUaServiceFactory = ({ actorOrgId }: TUpdateUaDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral) throw new BadRequestError({ message: "Failed to updated universal auth" @@ -320,7 +316,7 @@ export const identityUaServiceFactory = ({ const getIdentityUniversalAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetUaDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral) throw new BadRequestError({ message: "The identity does not have universal auth" @@ -347,7 +343,7 @@ export const identityUaServiceFactory = ({ actorOrgId }: TRevokeUaDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral) throw new BadRequestError({ message: "The identity does not have universal auth" @@ -393,7 +389,7 @@ export const identityUaServiceFactory = ({ numUsesLimit }: TCreateUaClientSecretDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral) throw new BadRequestError({ message: "The identity does not have universal auth" @@ -453,7 +449,7 @@ export const identityUaServiceFactory = ({ identityId }: TGetUaClientSecretsDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral) throw new BadRequestError({ message: "The identity does not have universal auth" @@ -500,7 +496,7 @@ export const identityUaServiceFactory = ({ clientSecretId }: TGetUniversalAuthClientSecretByIdDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral) throw new BadRequestError({ message: "The identity does not have universal auth" @@ -540,7 +536,7 @@ export const identityUaServiceFactory = ({ clientSecretId }: TRevokeUaClientSecretDTO) => { const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId }); - if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" }); + if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" }); if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral) throw new BadRequestError({ message: "The identity does not have universal auth" diff --git a/backend/src/services/identity/identity-service.ts b/backend/src/services/identity/identity-service.ts index b9cda4840..933a2b17a 100644 --- a/backend/src/services/identity/identity-service.ts +++ b/backend/src/services/identity/identity-service.ts @@ -55,8 +55,7 @@ export const identityServiceFactory = ({ ); const isCustomRole = Boolean(customRole); const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission); - if (!hasRequiredPriviledges) - throw new ForbiddenRequestError({ message: "Failed to create a more privileged identity" }); + if (!hasRequiredPriviledges) throw new BadRequestError({ message: "Failed to create a more privileged identity" }); const plan = await licenseService.getPlan(orgId); @@ -95,7 +94,7 @@ export const identityServiceFactory = ({ actorOrgId }: TUpdateIdentityDTO) => { const identityOrgMembership = await identityOrgMembershipDAL.findOne({ identityId: id }); - if (!identityOrgMembership) throw new NotFoundError({ message: `Failed to find identity with id ${id}` }); + if (!identityOrgMembership) throw new BadRequestError({ message: `Failed to find identity with id ${id}` }); const { permission } = await permissionService.getOrgPermission( actor, @@ -127,7 +126,7 @@ export const identityServiceFactory = ({ const isCustomRole = Boolean(customOrgRole); const hasRequiredNewRolePermission = isAtLeastAsPrivileged(permission, rolePermission); if (!hasRequiredNewRolePermission) - throw new ForbiddenRequestError({ message: "Failed to create a more privileged identity" }); + throw new BadRequestError({ message: "Failed to create a more privileged identity" }); if (isCustomRole) customRole = customOrgRole; } @@ -154,7 +153,7 @@ export const identityServiceFactory = ({ [`${TableName.IdentityOrgMembership}.identityId` as "identityId"]: id }); const identity = doc[0]; - if (!identity) throw new NotFoundError({ message: `Failed to find identity with id ${id}` }); + if (!identity) throw new BadRequestError({ message: `Failed to find identity with id ${id}` }); const { permission } = await permissionService.getOrgPermission( actor, @@ -169,7 +168,7 @@ export const identityServiceFactory = ({ const deleteIdentity = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TDeleteIdentityDTO) => { const identityOrgMembership = await identityOrgMembershipDAL.findOne({ identityId: id }); - if (!identityOrgMembership) throw new NotFoundError({ message: `Failed to find identity with id ${id}` }); + if (!identityOrgMembership) throw new BadRequestError({ message: `Failed to find identity with id ${id}` }); const { permission } = await permissionService.getOrgPermission( actor, diff --git a/backend/src/services/integration-auth/integration-app-list.ts b/backend/src/services/integration-auth/integration-app-list.ts index dd0cb16dc..95dac6800 100644 --- a/backend/src/services/integration-auth/integration-app-list.ts +++ b/backend/src/services/integration-auth/integration-app-list.ts @@ -2,7 +2,7 @@ import { Octokit } from "@octokit/rest"; import { request } from "@app/lib/config/request"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { Integrations, IntegrationUrls } from "./integration-list"; @@ -1192,6 +1192,6 @@ export const getApps = async ({ }); default: - throw new NotFoundError({ message: "integration not found" }); + throw new BadRequestError({ message: "integration not found" }); } }; diff --git a/backend/src/services/integration-auth/integration-auth-service.ts b/backend/src/services/integration-auth/integration-auth-service.ts index c3e0dfe06..7b201e6ea 100644 --- a/backend/src/services/integration-auth/integration-auth-service.ts +++ b/backend/src/services/integration-auth/integration-auth-service.ts @@ -7,7 +7,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { request } from "@app/lib/config/request"; import { decryptSymmetric128BitHexKeyUTF8, encryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectPermission } from "@app/lib/types"; import { TIntegrationDALFactory } from "../integration/integration-dal"; @@ -88,7 +88,7 @@ export const integrationAuthServiceFactory = ({ const getIntegrationAuth = async ({ actor, id, actorId, actorAuthMethod, actorOrgId }: TGetIntegrationAuthDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -162,7 +162,7 @@ export const integrationAuthServiceFactory = ({ updateDoc.encryptedAccess = accessToken; } } else { - if (!botKey) throw new NotFoundError({ message: "Project bot key not found" }); + if (!botKey) throw new BadRequestError({ message: "Bot key not found" }); if (tokenExchange.refreshToken) { const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenExchange.refreshToken, botKey); updateDoc.refreshIV = refreshEncToken.iv; @@ -273,7 +273,7 @@ export const integrationAuthServiceFactory = ({ } } } else { - if (!botKey) throw new NotFoundError({ message: "Project bot key not found" }); + if (!botKey) throw new BadRequestError({ message: "Bot key not found" }); if (refreshToken) { const tokenDetails = await exchangeRefresh( integration, @@ -379,7 +379,7 @@ export const integrationAuthServiceFactory = ({ // the old bot key is else } else { - if (!botKey) throw new NotFoundError({ message: "Project bot key not found" }); + if (!botKey) throw new BadRequestError({ message: "bot key is missing" }); if (integrationAuth.accessTag && integrationAuth.accessIV && integrationAuth.accessCiphertext) { accessToken = decryptSymmetric128BitHexKeyUTF8({ ciphertext: integrationAuth.accessCiphertext, @@ -445,7 +445,7 @@ export const integrationAuthServiceFactory = ({ workspaceSlug }: TIntegrationAuthAppsDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -478,7 +478,7 @@ export const integrationAuthServiceFactory = ({ id }: TIntegrationAuthTeamsDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -508,7 +508,7 @@ export const integrationAuthServiceFactory = ({ actorOrgId }: TIntegrationAuthVercelBranchesDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -549,7 +549,7 @@ export const integrationAuthServiceFactory = ({ accountId }: TIntegrationAuthChecklyGroupsDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -576,7 +576,7 @@ export const integrationAuthServiceFactory = ({ const getGithubOrgs = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TIntegrationAuthGithubOrgsDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -613,7 +613,7 @@ export const integrationAuthServiceFactory = ({ repoName }: TIntegrationAuthGithubEnvsDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -645,7 +645,7 @@ export const integrationAuthServiceFactory = ({ const getQoveryOrgs = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TIntegrationAuthQoveryOrgsDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -679,7 +679,7 @@ export const integrationAuthServiceFactory = ({ region }: TIntegrationAuthAwsKmsKeyDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -737,7 +737,7 @@ export const integrationAuthServiceFactory = ({ orgId }: TIntegrationAuthQoveryProjectDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -773,7 +773,7 @@ export const integrationAuthServiceFactory = ({ actorOrgId }: TIntegrationAuthQoveryEnvironmentsDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -814,7 +814,7 @@ export const integrationAuthServiceFactory = ({ environmentId }: TIntegrationAuthQoveryScopesDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -854,7 +854,7 @@ export const integrationAuthServiceFactory = ({ environmentId }: TIntegrationAuthQoveryScopesDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -894,7 +894,7 @@ export const integrationAuthServiceFactory = ({ environmentId }: TIntegrationAuthQoveryScopesDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -933,7 +933,7 @@ export const integrationAuthServiceFactory = ({ actorOrgId }: TIntegrationAuthHerokuPipelinesDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -973,7 +973,7 @@ export const integrationAuthServiceFactory = ({ appId }: TIntegrationAuthRailwayEnvDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1041,7 +1041,7 @@ export const integrationAuthServiceFactory = ({ appId }: TIntegrationAuthRailwayServicesDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1115,7 +1115,7 @@ export const integrationAuthServiceFactory = ({ id }: TIntegrationAuthBitbucketWorkspaceDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1164,7 +1164,7 @@ export const integrationAuthServiceFactory = ({ appId }: TIntegrationAuthNorthflankSecretGroupDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1232,7 +1232,7 @@ export const integrationAuthServiceFactory = ({ actor }: TGetIntegrationAuthTeamCityBuildConfigDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1294,7 +1294,7 @@ export const integrationAuthServiceFactory = ({ actorOrgId }: TDeleteIntegrationAuthByIdDTO) => { const integrationAuth = await integrationAuthDAL.findById(id); - if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" }); + if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1307,7 +1307,7 @@ export const integrationAuthServiceFactory = ({ const delIntegrationAuth = await integrationAuthDAL.transaction(async (tx) => { const doc = await integrationAuthDAL.deleteById(integrationAuth.id, tx); - if (!doc) throw new NotFoundError({ message: "Faled to find integration" }); + if (!doc) throw new BadRequestError({ message: "Faled to find integration" }); await integrationDAL.delete({ integrationAuthId: doc.id }, tx); return doc; }); diff --git a/backend/src/services/integration-auth/integration-token.ts b/backend/src/services/integration-auth/integration-token.ts index ba26a3aaa..0907bd074 100644 --- a/backend/src/services/integration-auth/integration-token.ts +++ b/backend/src/services/integration-auth/integration-token.ts @@ -2,7 +2,7 @@ import jwt from "jsonwebtoken"; import { getConfig } from "@app/lib/config/env"; import { request } from "@app/lib/config/request"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { Integrations, IntegrationUrls } from "./integration-list"; @@ -396,7 +396,7 @@ export const exchangeCode = async ({ code }); default: - throw new NotFoundError({ message: "Unknown integration" }); + throw new BadRequestError({ message: "Unknown integration" }); } }; diff --git a/backend/src/services/integration/integration-service.ts b/backend/src/services/integration/integration-service.ts index 5e77f4349..029825baa 100644 --- a/backend/src/services/integration/integration-service.ts +++ b/backend/src/services/integration/integration-service.ts @@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { TProjectPermission } from "@app/lib/types"; import { TIntegrationAuthDALFactory } from "../integration-auth/integration-auth-dal"; @@ -76,7 +76,7 @@ export const integrationServiceFactory = ({ targetEnvironmentId }: TCreateIntegrationDTO) => { const integrationAuth = await integrationAuthDAL.findById(integrationAuthId); - if (!integrationAuth) throw new NotFoundError({ message: "Integration auth not found" }); + if (!integrationAuth) throw new BadRequestError({ message: "Integration auth not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -93,7 +93,7 @@ export const integrationServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(integrationAuth.projectId, sourceEnvironment, secretPath); - if (!folder) throw new NotFoundError({ message: "Folder path not found" }); + if (!folder) throw new BadRequestError({ message: "Folder path not found" }); const integration = await integrationDAL.create({ envId: folder.envId, @@ -139,7 +139,7 @@ export const integrationServiceFactory = ({ metadata }: TUpdateIntegrationDTO) => { const integration = await integrationDAL.findById(id); - if (!integration) throw new NotFoundError({ message: "Integration auth not found" }); + if (!integration) throw new BadRequestError({ message: "Integration auth not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -156,7 +156,7 @@ export const integrationServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(integration.projectId, environment, secretPath); - if (!folder) throw new NotFoundError({ message: "Folder path not found" }); + if (!folder) throw new BadRequestError({ message: "Folder path not found" }); const updatedIntegration = await integrationDAL.updateById(id, { envId: folder.envId, @@ -211,7 +211,7 @@ export const integrationServiceFactory = ({ shouldDeleteIntegrationSecrets }: TDeleteIntegrationDTO) => { const integration = await integrationDAL.findById(id); - if (!integration) throw new NotFoundError({ message: "Integration auth not found" }); + if (!integration) throw new BadRequestError({ message: "Integration auth not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -285,7 +285,7 @@ export const integrationServiceFactory = ({ const syncIntegration = async ({ id, actorId, actor, actorOrgId, actorAuthMethod }: TSyncIntegrationDTO) => { const integration = await integrationDAL.findById(id); if (!integration) { - throw new NotFoundError({ message: "Integration not found" }); + throw new BadRequestError({ message: "Integration not found" }); } const { permission } = await permissionService.getProjectPermission( diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index ad06906df..b987f2e3b 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -14,7 +14,7 @@ import { getConfig } from "@app/lib/config/env"; import { randomSecureBytes } from "@app/lib/crypto"; import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher"; import { generateHash } from "@app/lib/crypto/encryption"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; @@ -105,7 +105,7 @@ export const kmsServiceFactory = ({ const deleteInternalKms = async (kmsId: string, orgId: string, tx?: Knex) => { const kms = await kmsDAL.findByIdWithAssociatedKms(kmsId, tx); if (kms.isExternal) return; - if (kms.orgId !== orgId) throw new ForbiddenRequestError({ message: "KMS doesn't belong to organization" }); + if (kms.orgId !== orgId) throw new BadRequestError({ message: "KMS doesn't belong to organization" }); return kmsDAL.deleteById(kmsId, tx); }; @@ -638,7 +638,7 @@ export const kmsServiceFactory = ({ } if (kmsDoc.orgId !== project.orgId) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "KMS ID does not belong in the organization." }); } @@ -722,8 +722,8 @@ export const kmsServiceFactory = ({ } if (backupProjectId !== projectId) { - throw new ForbiddenRequestError({ - message: "Backup does not belong to project" + throw new BadRequestError({ + message: "Invalid backup for project" }); } diff --git a/backend/src/services/org-admin/org-admin-service.ts b/backend/src/services/org-admin/org-admin-service.ts index ac318e9e1..4ee192c88 100644 --- a/backend/src/services/org-admin/org-admin-service.ts +++ b/backend/src/services/org-admin/org-admin-service.ts @@ -4,7 +4,7 @@ import { ProjectMembershipRole, ProjectVersion, SecretKeyEncoding } from "@app/d import { OrgPermissionAdminConsoleAction, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectDALFactory } from "../project/project-dal"; import { assignWorkspaceKeysToMembers } from "../project/project-fns"; @@ -90,7 +90,7 @@ export const orgAdminServiceFactory = ({ ); const project = await projectDAL.findById(projectId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); if (project.version === ProjectVersion.V1) { throw new BadRequestError({ message: "Please upgrade your project on your dashboard" }); @@ -119,22 +119,22 @@ export const orgAdminServiceFactory = ({ // missing membership thus add admin back as admin to project const ghostUser = await projectDAL.findProjectGhostUser(projectId); if (!ghostUser) { - throw new NotFoundError({ - message: "Failed to find project owner" + throw new BadRequestError({ + message: "Failed to find sudo user" }); } const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, projectId); if (!ghostUserLatestKey) { - throw new NotFoundError({ - message: "Failed to find project owner's latest key" + throw new BadRequestError({ + message: "Failed to find sudo user latest key" }); } const bot = await projectBotDAL.findOne({ projectId }); if (!bot) { - throw new NotFoundError({ - message: "Failed to find project bot" + throw new BadRequestError({ + message: "Failed to find bot" }); } @@ -146,7 +146,7 @@ export const orgAdminServiceFactory = ({ }); const userEncryptionKey = await userDAL.findUserEncKeyByUserId(actorId); - if (!userEncryptionKey) throw new NotFoundError({ message: "User encryption key not found" }); + if (!userEncryptionKey) throw new BadRequestError({ message: "user encryption key not found" }); const [newWsMember] = assignWorkspaceKeysToMembers({ decryptKey: ghostUserLatestKey, userPrivateKey: botPrivateKey, diff --git a/backend/src/services/org/org-role-service.ts b/backend/src/services/org/org-role-service.ts index 023cbeccf..d734d7818 100644 --- a/backend/src/services/org/org-role-service.ts +++ b/backend/src/services/org/org-role-service.ts @@ -10,7 +10,7 @@ import { OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { ActorAuthMethod } from "../auth/auth-type"; import { TOrgRoleDALFactory } from "./org-role-dal"; @@ -91,7 +91,7 @@ export const orgRoleServiceFactory = ({ orgRoleDAL, permissionService }: TOrgRol } default: { const role = await orgRoleDAL.findOne({ id: roleId, orgId }); - if (!role) throw new NotFoundError({ message: "Organization role not found" }); + if (!role) throw new BadRequestError({ message: "Role not found", name: "Get role" }); return role; } } @@ -116,7 +116,7 @@ export const orgRoleServiceFactory = ({ orgRoleDAL, permissionService }: TOrgRol { id: roleId, orgId }, { ...data, permissions: data.permissions ? JSON.stringify(data.permissions) : undefined } ); - if (!updatedRole) throw new NotFoundError({ message: "Organization role not found" }); + if (!updatedRole) throw new BadRequestError({ message: "Role not found", name: "Update role" }); return updatedRole; }; @@ -130,7 +130,7 @@ export const orgRoleServiceFactory = ({ orgRoleDAL, permissionService }: TOrgRol const { permission } = await permissionService.getUserOrgPermission(userId, orgId, actorAuthMethod, actorOrgId); ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Role); const [deletedRole] = await orgRoleDAL.delete({ id: roleId, orgId }); - if (!deletedRole) throw new NotFoundError({ message: "Organization role not found", name: "Update role" }); + if (!deletedRole) throw new BadRequestError({ message: "Role not found", name: "Update role" }); return deletedRole; }; diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts index c80cbba67..8417f2444 100644 --- a/backend/src/services/org/org-service.ts +++ b/backend/src/services/org/org-service.ts @@ -27,7 +27,7 @@ import { getConfig } from "@app/lib/config/env"; import { generateAsymmetricKeyPair } from "@app/lib/crypto"; import { generateSymmetricKey, infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; import { generateUserSrpKeys } from "@app/lib/crypto/srp"; -import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { isDisposableEmail } from "@app/lib/validator"; @@ -128,7 +128,7 @@ export const orgServiceFactory = ({ ) => { await permissionService.getUserOrgPermission(userId, orgId, actorAuthMethod, actorOrgId); const org = await orgDAL.findOrgById(orgId); - if (!org) throw new NotFoundError({ message: "Organization not found" }); + if (!org) throw new BadRequestError({ name: "Org not found", message: "Organization not found" }); return org; }; /* @@ -286,7 +286,8 @@ export const orgServiceFactory = ({ if (authEnforced) { const samlCfg = await samlConfigDAL.findEnforceableSamlCfg(orgId); if (!samlCfg) - throw new NotFoundError({ + throw new BadRequestError({ + name: "No enforceable SAML config found", message: "No enforceable SAML config found" }); } @@ -297,7 +298,7 @@ export const orgServiceFactory = ({ authEnforced, scimEnabled }); - if (!org) throw new NotFoundError({ message: "Organization not found" }); + if (!org) throw new BadRequestError({ name: "Org not found", message: "Organization not found" }); return org; }; /* @@ -382,10 +383,7 @@ export const orgServiceFactory = ({ ) => { const { membership } = await permissionService.getUserOrgPermission(userId, orgId, actorAuthMethod, actorOrgId); if ((membership.role as OrgMembershipRole) !== OrgMembershipRole.Admin) - throw new ForbiddenRequestError({ - name: "DeleteOrganizationById", - message: "Insufficient privileges" - }); + throw new UnauthorizedError({ name: "Delete org by id", message: "Not an admin" }); const organization = await orgDAL.deleteById(orgId); if (organization.customerId) { @@ -415,12 +413,12 @@ export const orgServiceFactory = ({ }); if (!foundMembership) throw new NotFoundError({ message: "Failed to find organization membership" }); if (foundMembership.userId === userId) - throw new UnauthorizedError({ message: "Cannot update own organization membership" }); + throw new BadRequestError({ message: "Cannot update own organization membership" }); const isCustomRole = !Object.values(OrgMembershipRole).includes(role as OrgMembershipRole); if (role && isCustomRole) { const customRole = await orgRoleDAL.findOne({ slug: role, orgId }); - if (!customRole) throw new BadRequestError({ name: "UpdateMembership", message: "Organization role not found" }); + if (!customRole) throw new BadRequestError({ name: "Update membership", message: "Role not found" }); const plan = await licenseService.getPlan(orgId); if (!plan?.rbac) @@ -463,8 +461,8 @@ export const orgServiceFactory = ({ const isEmailInvalid = await isDisposableEmail(inviteeEmails); if (isEmailInvalid) { throw new BadRequestError({ - message: "Disposable emails are not allowed", - name: "InviteUser" + message: "Provided a disposable email", + name: "Org invite" }); } const plan = await licenseService.getPlan(orgId); @@ -485,8 +483,8 @@ export const orgServiceFactory = ({ }) : []; if (projectsToInvite.length !== invitedProjects?.length) { - throw new ForbiddenRequestError({ - message: "Access denied to one or more of the specified projects" + throw new UnauthorizedError({ + message: "One or more project doesn't have access to" }); } @@ -497,7 +495,7 @@ export const orgServiceFactory = ({ } const mailsForOrgInvitation: { email: string; userId: string; firstName: string; lastName: string }[] = []; - const mailsForProjectInvitation: { email: string[]; projectName: string }[] = []; + const mailsForProjectInvitaion: { email: string[]; projectName: string }[] = []; const newProjectMemberships: TProjectMemberships[] = []; await orgDAL.transaction(async (tx) => { const users: Pick[] = []; @@ -565,7 +563,6 @@ export const orgServiceFactory = ({ if (plan?.slug !== "enterprise" && plan?.memberLimit && plan.membersUsed >= plan.memberLimit) { // limit imposed on number of members allowed / number of members used exceeds the number of members allowed throw new BadRequestError({ - name: "InviteUser", message: "Failed to invite member due to member limit reached. Upgrade plan to invite more members." }); } @@ -573,14 +570,12 @@ export const orgServiceFactory = ({ if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) { // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed throw new BadRequestError({ - name: "InviteUser", message: "Failed to invite member due to member limit reached. Upgrade plan to invite more members." }); } if (org?.authEnforced) { - throw new ForbiddenRequestError({ - name: "InviteUser", + throw new BadRequestError({ message: "Failed to invite user due to org-level auth enforced for organization" }); } @@ -592,7 +587,7 @@ export const orgServiceFactory = ({ if (isCustomOrgRole) { const customRole = await orgRoleDAL.findOne({ slug: organizationRoleSlug, orgId }); if (!customRole) - throw new NotFoundError({ name: "InviteUser", message: "Custom organization role not found" }); + throw new BadRequestError({ name: "Invite membership", message: "Organization role not found" }); roleId = customRole.id; } @@ -665,7 +660,6 @@ export const orgServiceFactory = ({ if (hasCustomRole) { if (!plan?.rbac) throw new BadRequestError({ - name: "InviteUser", message: "Failed to assign custom role due to RBAC restriction. Upgrade plan to assign custom role to member." }); @@ -677,33 +671,29 @@ export const orgServiceFactory = ({ $in: { slug: customProjectRoles.map((role) => role) } }) : []; - if (customRoles.length !== customProjectRoles.length) { - throw new NotFoundError({ name: "InviteUser", message: "Custom project role not found" }); - } + if (customRoles.length !== customProjectRoles.length) + throw new BadRequestError({ message: "Custom role not found" }); const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug); const ghostUser = await projectDAL.findProjectGhostUser(projectId, tx); if (!ghostUser) { - throw new NotFoundError({ - name: "InviteUser", - message: "Failed to find project owner" + throw new BadRequestError({ + message: "Failed to find sudo user" }); } const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, projectId, tx); if (!ghostUserLatestKey) { - throw new NotFoundError({ - name: "InviteUser", - message: "Failed to find project owner's latest key" + throw new BadRequestError({ + message: "Failed to find sudo user latest key" }); } const bot = await projectBotDAL.findOne({ projectId }, tx); if (!bot) { - throw new NotFoundError({ - name: "InviteUser", - message: "Failed to find project bot" + throw new BadRequestError({ + message: "Failed to find bot" }); } @@ -756,7 +746,7 @@ export const orgServiceFactory = ({ })), tx ); - mailsForProjectInvitation.push({ + mailsForProjectInvitaion.push({ email: userWithEncryptionKeyInvitedToProject .filter((el) => !userIdsWithOrgInvitation.has(el.userId)) .map((el) => el.email || el.username), @@ -800,7 +790,7 @@ export const orgServiceFactory = ({ ); await Promise.allSettled( - mailsForProjectInvitation + mailsForProjectInvitaion .filter((el) => Boolean(el.email.length)) .map(async (el) => { return smtpService.sendMail({ @@ -829,17 +819,17 @@ export const orgServiceFactory = ({ const verifyUserToOrg = async ({ orgId, email, code }: TVerifyUserToOrgDTO) => { const user = await userDAL.findUserByUsername(email); if (!user) { - throw new NotFoundError({ message: "User not found" }); + throw new BadRequestError({ message: "Invalid request", name: "Verify user to org" }); } const [orgMembership] = await orgDAL.findMembership({ [`${TableName.OrgMembership}.userId` as "userId"]: user.id, status: OrgMembershipStatus.Invited, [`${TableName.OrgMembership}.orgId` as "orgId"]: orgId }); - if (!orgMembership) - throw new NotFoundError({ - message: "No pending invitation found" + throw new BadRequestError({ + message: "Failed to find invitation", + name: "Verify user to org" }); await tokenService.validateTokenForUser({ @@ -891,12 +881,8 @@ export const orgServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Member); const membership = await orgMembershipDAL.findOrgMembershipById(membershipId); - if (!membership) { - throw new NotFoundError({ message: "Failed to find organization membership" }); - } - if (membership.orgId !== orgId) { - throw new ForbiddenRequestError({ message: "Membership does not belong to organization" }); - } + if (!membership) throw new NotFoundError({ message: "Failed to find organization membership" }); + if (membership.orgId !== orgId) throw new NotFoundError({ message: "Failed to find organization membership" }); return membership; }; diff --git a/backend/src/services/pki-alert/pki-alert-service.ts b/backend/src/services/pki-alert/pki-alert-service.ts index 07af806b3..26ab380fb 100644 --- a/backend/src/services/pki-alert/pki-alert-service.ts +++ b/backend/src/services/pki-alert/pki-alert-service.ts @@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { NotFoundError, UnauthorizedError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { TPkiCollectionDALFactory } from "@app/services/pki-collection/pki-collection-dal"; import { pkiItemTypeToNameMap } from "@app/services/pki-collection/pki-collection-types"; @@ -86,7 +86,7 @@ export const pkiAlertServiceFactory = ({ const pkiCollection = await pkiCollectionDAL.findById(pkiCollectionId); if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" }); if (pkiCollection.projectId !== projectId) - throw new ForbiddenRequestError({ message: "PKI collection does not belong to the specified project." }); + throw new UnauthorizedError({ message: "PKI collection not found in project" }); const alert = await pkiAlertDAL.create({ projectId, @@ -141,9 +141,8 @@ export const pkiAlertServiceFactory = ({ if (pkiCollectionId) { const pkiCollection = await pkiCollectionDAL.findById(pkiCollectionId); if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" }); - if (pkiCollection.projectId !== alert.projectId) { - throw new ForbiddenRequestError({ message: "PKI collection does not belong to the specified project." }); - } + if (pkiCollection.projectId !== alert.projectId) + throw new UnauthorizedError({ message: "PKI collection not found in project" }); } alert = await pkiAlertDAL.updateById(alertId, { diff --git a/backend/src/services/project-bot/project-bot-fns.ts b/backend/src/services/project-bot/project-bot-fns.ts index 252fd03e5..4efcbb34b 100644 --- a/backend/src/services/project-bot/project-bot-fns.ts +++ b/backend/src/services/project-bot/project-bot-fns.ts @@ -6,7 +6,7 @@ import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal"; import { TProjectDALFactory } from "../project/project-dal"; @@ -27,7 +27,7 @@ export const getBotKeyFnFactory = ( const getBotKeyFn = async (projectId: string) => { const project = await projectDAL.findById(projectId); if (!project) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project not found during bot lookup. Are you sure you are using the correct project ID?" }); @@ -39,7 +39,7 @@ export const getBotKeyFnFactory = ( if (!bot || !bot.isActive || !bot.encryptedProjectKey || !bot.encryptedProjectKeyNonce) { // trying to set bot automatically const projectV1Keys = await projectBotDAL.findProjectUserWorkspaceKey(projectId); - if (!projectV1Keys) throw new NotFoundError({ message: "Bot not found. Please ask admin user to login" }); + if (!projectV1Keys) throw new BadRequestError({ message: "Bot not found. Please ask admin user to login" }); let userPrivateKey = ""; if ( diff --git a/backend/src/services/project-bot/project-bot-service.ts b/backend/src/services/project-bot/project-bot-service.ts index cc327df54..1df29e6b7 100644 --- a/backend/src/services/project-bot/project-bot-service.ts +++ b/backend/src/services/project-bot/project-bot-service.ts @@ -5,7 +5,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { generateAsymmetricKeyPair } from "@app/lib/crypto"; import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectDALFactory } from "../project/project-dal"; import { TProjectBotDALFactory } from "./project-bot-dal"; @@ -91,7 +91,7 @@ export const projectBotServiceFactory = ({ const bot = await projectBotDAL.findProjectByBotId(botId); return bot; } catch (e) { - throw new NotFoundError({ message: "Failed to find bot by ID" }); + throw new BadRequestError({ message: "Failed to find bot by ID" }); } }; @@ -105,7 +105,7 @@ export const projectBotServiceFactory = ({ isActive }: TSetActiveStateDTO) => { const bot = await projectBotDAL.findById(botId); - if (!bot) throw new NotFoundError({ message: "Bot not found" }); + if (!bot) throw new BadRequestError({ message: "Bot not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -119,7 +119,7 @@ export const projectBotServiceFactory = ({ const project = await projectBotDAL.findProjectByBotId(botId); if (!project) { - throw new NotFoundError({ message: "Failed to find project by bot ID" }); + throw new BadRequestError({ message: "Failed to find project by bot ID" }); } if (project.version === ProjectVersion.V2) { @@ -128,7 +128,7 @@ export const projectBotServiceFactory = ({ if (isActive) { if (!botKey?.nonce || !botKey?.encryptedKey) { - throw new NotFoundError({ message: "Bot key not found, failed to set bot active" }); + throw new BadRequestError({ message: "Failed to set bot active - missing bot key" }); } const doc = await projectBotDAL.updateById(botId, { isActive: true, diff --git a/backend/src/services/project-env/project-env-service.ts b/backend/src/services/project-env/project-env-service.ts index b39518066..c7af817bd 100644 --- a/backend/src/services/project-env/project-env-service.ts +++ b/backend/src/services/project-env/project-env-service.ts @@ -50,7 +50,7 @@ export const projectEnvServiceFactory = ({ if (existingEnv) throw new BadRequestError({ message: "Environment with slug already exist", - name: "CreateEnvironment" + name: "Create envv" }); const project = await projectDAL.findById(projectId); @@ -94,14 +94,14 @@ export const projectEnvServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Environments); const oldEnv = await projectEnvDAL.findOne({ id, projectId }); - if (!oldEnv) throw new NotFoundError({ message: "Environment not found" }); + if (!oldEnv) throw new BadRequestError({ message: "Environment not found" }); if (slug) { const existingEnv = await projectEnvDAL.findOne({ slug, projectId }); if (existingEnv && existingEnv.id !== id) { throw new BadRequestError({ message: "Environment with slug already exist", - name: "UpdateEnvironment" + name: "Create envv" }); } } @@ -128,9 +128,9 @@ export const projectEnvServiceFactory = ({ const env = await projectEnvDAL.transaction(async (tx) => { const [doc] = await projectEnvDAL.delete({ id, projectId }, tx); if (!doc) - throw new NotFoundError({ + throw new BadRequestError({ message: "Env doesn't exist", - name: "DeleteEnvironment" + name: "Re-order env" }); await projectEnvDAL.updateAllPosition(projectId, doc.position, -1, tx); diff --git a/backend/src/services/project-membership/project-membership-service.ts b/backend/src/services/project-membership/project-membership-service.ts index dc063d76d..236963a7c 100644 --- a/backend/src/services/project-membership/project-membership-service.ts +++ b/backend/src/services/project-membership/project-membership-service.ts @@ -8,7 +8,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal"; import { getConfig } from "@app/lib/config/env"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { TUserGroupMembershipDALFactory } from "../../ee/services/group/user-group-membership-dal"; @@ -143,7 +143,7 @@ export const projectMembershipServiceFactory = ({ sendEmails = true }: TAddUsersToWorkspaceDTO) => { const project = await projectDAL.findById(projectId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -236,7 +236,10 @@ export const projectMembershipServiceFactory = ({ const membershipUser = await userDAL.findUserByProjectMembershipId(membershipId); if (membershipUser?.isGhost || membershipUser?.projectId !== projectId) { - throw new ForbiddenRequestError({ message: "Forbidden member update" }); + throw new BadRequestError({ + message: "Unauthorized member update", + name: "Update project membership" + }); } // validate custom roles input @@ -258,9 +261,7 @@ export const projectMembershipServiceFactory = ({ $in: { slug: customInputRoles.map(({ role }) => role) } }) : []; - if (customRoles.length !== customInputRoles.length) { - throw new NotFoundError({ message: "Custom project roles not found" }); - } + if (customRoles.length !== customInputRoles.length) throw new BadRequestError({ message: "Custom role not found" }); const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug); const sanitizedProjectMembershipRoles = roles.map((inputRole) => { @@ -316,9 +317,9 @@ export const projectMembershipServiceFactory = ({ const member = await userDAL.findUserByProjectMembershipId(membershipId); if (member?.isGhost) { - throw new ForbiddenRequestError({ - message: "Forbidden membership deletion", - name: "DeleteProjectMembership" + throw new BadRequestError({ + message: "Unauthorized member delete", + name: "Delete project membership" }); } @@ -351,8 +352,9 @@ export const projectMembershipServiceFactory = ({ const project = await projectDAL.findById(projectId); if (!project) { - throw new NotFoundError({ - message: "Project not found" + throw new BadRequestError({ + message: "Project not found", + name: "Delete project membership" }); } @@ -426,7 +428,7 @@ export const projectMembershipServiceFactory = ({ } const project = await projectDAL.findById(projectId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); if (project.version === ProjectVersion.V1) { throw new BadRequestError({ @@ -437,7 +439,7 @@ export const projectMembershipServiceFactory = ({ const projectMembers = await projectMembershipDAL.findAllProjectMembers(projectId); if (!projectMembers?.length) { - throw new NotFoundError({ message: "Failed to find project members" }); + throw new BadRequestError({ message: "Failed to find project members" }); } if (projectMembers.length < 2) { diff --git a/backend/src/services/project-role/project-role-service.ts b/backend/src/services/project-role/project-role-service.ts index a1e22504f..6e9b68d9d 100644 --- a/backend/src/services/project-role/project-role-service.ts +++ b/backend/src/services/project-role/project-role-service.ts @@ -10,7 +10,7 @@ import { ProjectPermissionSub, validateProjectPermissions } from "@app/ee/services/permission/project-permission"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { ActorAuthMethod } from "../auth/auth-type"; import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/identity-project-membership-role-dal"; @@ -44,7 +44,7 @@ export const projectRoleServiceFactory = ({ }: TProjectRoleServiceFactoryDep) => { const createRole = async ({ projectSlug, data, actor, actorId, actorAuthMethod, actorOrgId }: TCreateRoleDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -56,9 +56,7 @@ export const projectRoleServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Role); const existingRole = await projectRoleDAL.findOne({ slug: data.slug, projectId }); - if (existingRole) { - throw new BadRequestError({ name: "Create Role", message: "Project role with same slug already exists" }); - } + if (existingRole) throw new BadRequestError({ name: "Create Role", message: "Duplicate role" }); validateProjectPermissions(data.permissions); @@ -78,7 +76,7 @@ export const projectRoleServiceFactory = ({ roleSlug }: TGetRoleBySlugDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -95,7 +93,7 @@ export const projectRoleServiceFactory = ({ } const customRole = await projectRoleDAL.findOne({ slug: roleSlug, projectId }); - if (!customRole) throw new NotFoundError({ message: "Project role not found" }); + if (!customRole) throw new BadRequestError({ message: "Role not found" }); return { ...customRole, permissions: unpackPermissions(customRole.permissions) }; }; @@ -109,7 +107,7 @@ export const projectRoleServiceFactory = ({ data }: TUpdateRoleDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -124,7 +122,7 @@ export const projectRoleServiceFactory = ({ if (data?.slug) { const existingRole = await projectRoleDAL.findOne({ slug: data.slug, projectId }); if (existingRole && existingRole.id !== roleId) - throw new BadRequestError({ name: "Update Role", message: "Project role with the same slug already exists" }); + throw new BadRequestError({ name: "Update Role", message: "Duplicate role" }); } if (data.permissions) { @@ -138,13 +136,13 @@ export const projectRoleServiceFactory = ({ permissions: data.permissions ? data.permissions : undefined } ); - if (!updatedRole) throw new NotFoundError({ message: "Project role not found", name: "Update role" }); + if (!updatedRole) throw new BadRequestError({ message: "Role not found", name: "Update role" }); return { ...updatedRole, permissions: unpackPermissions(updatedRole.permissions) }; }; const deleteRole = async ({ actor, actorId, actorAuthMethod, actorOrgId, projectSlug, roleId }: TDeleteRoleDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); const projectId = project.id; const { permission } = await permissionService.getProjectPermission( @@ -173,7 +171,7 @@ export const projectRoleServiceFactory = ({ } const [deletedRole] = await projectRoleDAL.delete({ id: roleId, projectId }); - if (!deletedRole) throw new NotFoundError({ message: "Project role not found", name: "Delete role" }); + if (!deletedRole) throw new BadRequestError({ message: "Role not found", name: "Delete role" }); return { ...deletedRole, permissions: unpackPermissions(deletedRole.permissions) }; }; diff --git a/backend/src/services/project/project-dal.ts b/backend/src/services/project/project-dal.ts index 69cd8933f..64500814f 100644 --- a/backend/src/services/project/project-dal.ts +++ b/backend/src/services/project/project-dal.ts @@ -2,7 +2,7 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { ProjectsSchema, ProjectUpgradeStatus, ProjectVersion, TableName, TProjectsUpdate } from "@app/db/schemas"; -import { BadRequestError, DatabaseError, NotFoundError, UnauthorizedError } from "@app/lib/errors"; +import { BadRequestError, DatabaseError } from "@app/lib/errors"; import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex"; import { Filter, ProjectFilterType } from "./project-types"; @@ -186,7 +186,7 @@ export const projectDALFactory = (db: TDbClient) => { })?.[0]; if (!project) { - throw new NotFoundError({ message: "Project not found" }); + throw new BadRequestError({ message: "Project not found" }); } return project; @@ -198,7 +198,7 @@ export const projectDALFactory = (db: TDbClient) => { const findProjectBySlug = async (slug: string, orgId: string | undefined) => { try { if (!orgId) { - throw new UnauthorizedError({ message: "Organization ID is required when querying with slugs" }); + throw new BadRequestError({ message: "Organization ID is required when querying with slugs" }); } const projects = await db @@ -235,7 +235,7 @@ export const projectDALFactory = (db: TDbClient) => { })?.[0]; if (!project) { - throw new NotFoundError({ message: "Project not found" }); + throw new BadRequestError({ message: "Project not found" }); } return project; @@ -251,7 +251,7 @@ export const projectDALFactory = (db: TDbClient) => { } if (filter.type === ProjectFilterType.SLUG) { if (!filter.orgId) { - throw new UnauthorizedError({ + throw new BadRequestError({ message: "Organization ID is required when querying with slugs" }); } @@ -295,7 +295,7 @@ export const projectDALFactory = (db: TDbClient) => { .first(); if (!project) { - throw new NotFoundError({ message: "Project not found" }); + throw new BadRequestError({ message: "Project not found" }); } return { diff --git a/backend/src/services/project/project-fns.ts b/backend/src/services/project/project-fns.ts index 217f289dd..d6b01c33b 100644 --- a/backend/src/services/project/project-fns.ts +++ b/backend/src/services/project/project-fns.ts @@ -2,7 +2,7 @@ import crypto from "crypto"; import { ProjectVersion, TProjects } from "@app/db/schemas"; import { decryptAsymmetric, encryptAsymmetric } from "@app/lib/crypto"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; @@ -75,7 +75,7 @@ export const getProjectKmsCertificateKeyId = async ({ const keyId = await projectDAL.transaction(async (tx) => { const project = await projectDAL.findOne({ id: projectId }, tx); if (!project) { - throw new NotFoundError({ message: "Project not found" }); + throw new BadRequestError({ message: "Project not found" }); } if (!project.kmsCertificateKeyId) { diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index a39d42ebe..31ab297b8 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -175,7 +175,7 @@ export const projectServiceFactory = ({ const kms = await kmsService.getKmsById(kmsKeyId, tx); if (kms.orgId !== organization.id) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "KMS does not belong in the organization" }); } @@ -321,7 +321,7 @@ export const projectServiceFactory = ({ // If identity org membership not found, throw error if (!identityOrgMembership) { - throw new NotFoundError({ + throw new BadRequestError({ message: `Failed to find identity with id ${actorId}` }); } @@ -490,7 +490,7 @@ export const projectServiceFactory = ({ }: TUpdateProjectVersionLimitDTO) => { const project = await projectDAL.findProjectBySlug(workspaceSlug, actorOrgId); if (!project) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Project not found" }); } @@ -504,9 +504,7 @@ export const projectServiceFactory = ({ ); if (!hasRole(ProjectMembershipRole.Admin)) - throw new ForbiddenRequestError({ - message: "Insufficient privileges, only admins are allowed to take this action" - }); + throw new BadRequestError({ message: "Only admins are allowed to take this action" }); return projectDAL.updateById(project.id, { pitVersionLimit }); }; @@ -535,9 +533,7 @@ export const projectServiceFactory = ({ ); if (!hasRole(ProjectMembershipRole.Admin)) { - throw new ForbiddenRequestError({ - message: "Insufficient privileges, only admins are allowed to take this action" - }); + throw new BadRequestError({ message: "Only admins are allowed to take this action" }); } const plan = await licenseService.getPlan(project.orgId); @@ -628,7 +624,7 @@ export const projectServiceFactory = ({ const project = await projectDAL.findProjectById(projectId); if (!project) { - throw new NotFoundError({ + throw new BadRequestError({ message: `Project with id ${projectId} not found` }); } @@ -986,7 +982,7 @@ export const projectServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings); if (slackIntegration.orgId !== project.orgId) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "Selected slack integration is not in the same organization" }); } diff --git a/backend/src/services/secret-blind-index/secret-blind-index-service.ts b/backend/src/services/secret-blind-index/secret-blind-index-service.ts index 6f603a693..bf2728e95 100644 --- a/backend/src/services/secret-blind-index/secret-blind-index-service.ts +++ b/backend/src/services/secret-blind-index/secret-blind-index-service.ts @@ -1,6 +1,6 @@ import { ProjectMembershipRole } from "@app/db/schemas"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; -import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { TSecretDALFactory } from "../secret/secret-dal"; import { generateSecretBlindIndexBySalt } from "../secret/secret-fns"; @@ -52,7 +52,7 @@ export const secretBlindIndexServiceFactory = ({ actorOrgId ); if (!hasRole(ProjectMembershipRole.Admin)) { - throw new ForbiddenRequestError({ message: "Insufficient privileges, user must be admin" }); + throw new UnauthorizedError({ message: "User must be admin" }); } const secrets = await secretBlindIndexDAL.findAllSecretsByProjectId(projectId); @@ -75,17 +75,17 @@ export const secretBlindIndexServiceFactory = ({ actorOrgId ); if (!hasRole(ProjectMembershipRole.Admin)) { - throw new ForbiddenRequestError({ message: "Insufficient privileges, user must be admin" }); + throw new UnauthorizedError({ message: "User must be admin" }); } const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" }); const secrets = await secretBlindIndexDAL.findSecretsByProjectId( projectId, secretsToUpdate.map(({ secretId }) => secretId) ); - if (secrets.length !== secretsToUpdate.length) throw new NotFoundError({ message: "Secret not found" }); + if (secrets.length !== secretsToUpdate.length) throw new BadRequestError({ message: "Secret not found" }); const operations = await Promise.all( secretsToUpdate.map(async ({ secretName, secretId: id }) => { diff --git a/backend/src/services/secret-folder/secret-folder-service.ts b/backend/src/services/secret-folder/secret-folder-service.ts index 7062a0c4f..d63518a80 100644 --- a/backend/src/services/secret-folder/secret-folder-service.ts +++ b/backend/src/services/secret-folder/secret-folder-service.ts @@ -76,7 +76,7 @@ export const secretFolderServiceFactory = ({ } const env = await projectEnvDAL.findOne({ projectId, slug: environment }); - if (!env) throw new NotFoundError({ message: "Environment not found", name: "Create folder" }); + if (!env) throw new BadRequestError({ message: "Environment not found", name: "Create folder" }); const folder = await folderDAL.transaction(async (tx) => { // the logic is simple we need to avoid creating same folder in same path multiple times @@ -86,7 +86,7 @@ export const secretFolderServiceFactory = ({ const pathWithFolder = path.join(secretPath, name); const parentFolder = await folderDAL.findClosestFolder(projectId, environment, pathWithFolder, tx); // no folder found is not possible root should be their - if (!parentFolder) throw new NotFoundError({ message: "Secret path not found" }); + if (!parentFolder) throw new BadRequestError({ message: "Secret path not found" }); // exact folder if (parentFolder.path === pathWithFolder) return parentFolder; @@ -149,7 +149,7 @@ export const secretFolderServiceFactory = ({ }: TUpdateManyFoldersDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); if (!project) { - throw new NotFoundError({ message: "Project not found" }); + throw new BadRequestError({ message: "Project not found" }); } const { permission } = await permissionService.getProjectPermission( @@ -184,12 +184,12 @@ export const secretFolderServiceFactory = ({ const parentFolder = await folderDAL.findBySecretPath(project.id, environment, secretPath); if (!parentFolder) { - throw new NotFoundError({ message: "Secret path not found", name: "Batch update folder" }); + throw new BadRequestError({ message: "Secret path not found", name: "Batch update folder" }); } const env = await projectEnvDAL.findOne({ projectId: project.id, slug: environment }); if (!env) { - throw new NotFoundError({ message: "Environment not found", name: "Batch update folder" }); + throw new BadRequestError({ message: "Environment not found", name: "Batch update folder" }); } const folder = await folderDAL .findOne({ envId: env.id, id, parentId: parentFolder.id }) @@ -198,7 +198,7 @@ export const secretFolderServiceFactory = ({ .catch(() => folderDAL.findOne({ envId: env.id, name: id, parentId: parentFolder.id })); if (!folder) { - throw new NotFoundError({ message: "Folder not found" }); + throw new BadRequestError({ message: "Folder not found" }); } if (name !== folder.name) { // ensure that new folder name is unique @@ -231,7 +231,7 @@ export const secretFolderServiceFactory = ({ tx ); if (!doc) { - throw new NotFoundError({ message: "Folder not found", name: "Batch update folder" }); + throw new BadRequestError({ message: "Folder not found", name: "Batch update folder" }); } return { oldFolder: folder, newFolder: doc }; @@ -283,17 +283,17 @@ export const secretFolderServiceFactory = ({ } const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath); - if (!parentFolder) throw new NotFoundError({ message: "Secret path not found" }); + if (!parentFolder) throw new BadRequestError({ message: "Secret path not found" }); const env = await projectEnvDAL.findOne({ projectId, slug: environment }); - if (!env) throw new NotFoundError({ message: "Environment not found", name: "Update folder" }); + if (!env) throw new BadRequestError({ message: "Environment not found", name: "Update folder" }); const folder = await folderDAL .findOne({ envId: env.id, id, parentId: parentFolder.id, isReserved: false }) // now folder api accepts id based change // this is for cli backward compatiability and when cli removes this, we will remove this logic .catch(() => folderDAL.findOne({ envId: env.id, name: id, parentId: parentFolder.id })); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); if (name !== folder.name) { // ensure that new folder name is unique const folderToCheck = await folderDAL.findOne({ @@ -325,7 +325,7 @@ export const secretFolderServiceFactory = ({ }, tx ); - if (!doc) throw new NotFoundError({ message: "Folder not found", name: "Update folder" }); + if (!doc) throw new BadRequestError({ message: "Folder not found", name: "Update folder" }); return doc; }); @@ -367,11 +367,11 @@ export const secretFolderServiceFactory = ({ } const env = await projectEnvDAL.findOne({ projectId, slug: environment }); - if (!env) throw new NotFoundError({ message: "Environment not found", name: "Create folder" }); + if (!env) throw new BadRequestError({ message: "Environment not found", name: "Create folder" }); const folder = await folderDAL.transaction(async (tx) => { const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath, tx); - if (!parentFolder) throw new NotFoundError({ message: "Secret path not found" }); + if (!parentFolder) throw new BadRequestError({ message: "Secret path not found" }); const [doc] = await folderDAL.delete( { @@ -382,7 +382,7 @@ export const secretFolderServiceFactory = ({ }, tx ); - if (!doc) throw new NotFoundError({ message: "Folder not found", name: "Delete folder" }); + if (!doc) throw new BadRequestError({ message: "Folder not found", name: "Delete folder" }); return doc; }); @@ -409,7 +409,7 @@ export const secretFolderServiceFactory = ({ await permissionService.getProjectPermission(actor, actorId, projectId, actorAuthMethod, actorOrgId); const env = await projectEnvDAL.findOne({ projectId, slug: environment }); - if (!env) throw new NotFoundError({ message: "Environment not found", name: "get folders" }); + if (!env) throw new BadRequestError({ message: "Environment not found", name: "get folders" }); const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!parentFolder) return []; @@ -448,7 +448,7 @@ export const secretFolderServiceFactory = ({ const envs = await projectEnvDAL.findBySlugs(projectId, environments); if (!envs.length) - throw new NotFoundError({ message: "Environment(s) not found", name: "get project folder count" }); + throw new BadRequestError({ message: "Environment(s) not found", name: "get project folder count" }); const parentFolders = await folderDAL.findBySecretPathMultiEnv(projectId, environments, secretPath); if (!parentFolders.length) return []; @@ -480,7 +480,7 @@ export const secretFolderServiceFactory = ({ const envs = await projectEnvDAL.findBySlugs(projectId, environments); if (!envs.length) - throw new NotFoundError({ message: "Environment(s) not found", name: "get project folder count" }); + throw new BadRequestError({ message: "Environment(s) not found", name: "get project folder count" }); const parentFolders = await folderDAL.findBySecretPathMultiEnv(projectId, environments, secretPath); if (!parentFolders.length) return 0; diff --git a/backend/src/services/secret-import/secret-import-service.ts b/backend/src/services/secret-import/secret-import-service.ts index 1481af2cd..f4dd03bf3 100644 --- a/backend/src/services/secret-import/secret-import-service.ts +++ b/backend/src/services/secret-import/secret-import-service.ts @@ -106,10 +106,10 @@ export const secretImportServiceFactory = ({ await projectDAL.checkProjectUpgradeStatus(projectId); const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); - if (!folder) throw new NotFoundError({ message: "Folder not found", name: "Create import" }); + if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Create import" }); const [importEnv] = await projectEnvDAL.findBySlugs(projectId, [data.environment]); - if (!importEnv) throw new NotFoundError({ error: "Imported env not found", name: "Create import" }); + if (!importEnv) throw new BadRequestError({ error: "Imported env not found", name: "Create import" }); const sourceFolder = await folderDAL.findBySecretPath(projectId, data.environment, data.path); if (sourceFolder) { @@ -118,7 +118,7 @@ export const secretImportServiceFactory = ({ importEnv: folder.environment.id, importPath: secretPath }); - if (existingImport) throw new NotFoundError({ message: "Cyclic import not allowed" }); + if (existingImport) throw new BadRequestError({ message: "Cyclic import not allowed" }); } const secImport = await secretImportDAL.transaction(async (tx) => { @@ -194,7 +194,7 @@ export const secretImportServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); - if (!folder) throw new NotFoundError({ message: "Folder not found", name: "Update import" }); + if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Update import" }); const secImpDoc = await secretImportDAL.findOne({ folderId: folder.id, id }); if (!secImpDoc) throw ERR_SEC_IMP_NOT_FOUND; @@ -202,7 +202,7 @@ export const secretImportServiceFactory = ({ const importedEnv = data.environment // this is get env information of new one or old one ? (await projectEnvDAL.findBySlugs(projectId, [data.environment]))?.[0] : await projectEnvDAL.findById(secImpDoc.importEnv); - if (!importedEnv) throw new NotFoundError({ error: "Imported env not found", name: "Create import" }); + if (!importedEnv) throw new BadRequestError({ error: "Imported env not found", name: "Create import" }); const sourceFolder = await folderDAL.findBySecretPath( projectId, @@ -215,7 +215,7 @@ export const secretImportServiceFactory = ({ importEnv: folder.environment.id, importPath: secretPath }); - if (existingImport) throw new NotFoundError({ message: "Cyclic import not allowed" }); + if (existingImport) throw new BadRequestError({ message: "Cyclic import not allowed" }); } const updatedSecImport = await secretImportDAL.transaction(async (tx) => { @@ -280,11 +280,11 @@ export const secretImportServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); - if (!folder) throw new NotFoundError({ message: "Folder not found", name: "Delete import" }); + if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Delete import" }); const secImport = await secretImportDAL.transaction(async (tx) => { const [doc] = await secretImportDAL.delete({ folderId: folder.id, id }, tx); - if (!doc) throw new NotFoundError({ message: "Secret import not found" }); + if (!doc) throw new BadRequestError({ name: "Sec imp del", message: "Secret import doc not found" }); if (doc.isReplication) { const replicationFolderPath = path.join(secretPath, getReplicationFolderName(doc.id)); const replicatedFolder = await folderDAL.findBySecretPath(projectId, environment, replicationFolderPath, tx); @@ -306,7 +306,7 @@ export const secretImportServiceFactory = ({ } const importEnv = await projectEnvDAL.findById(doc.importEnv); - if (!importEnv) throw new NotFoundError({ error: "Imported env not found" }); + if (!importEnv) throw new BadRequestError({ error: "Imported env not found", name: "Create import" }); return { ...doc, importEnv }; }); @@ -353,13 +353,13 @@ export const secretImportServiceFactory = ({ } const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Update import" }); const [secretImportDoc] = await secretImportDAL.find({ folderId: folder.id, [`${TableName.SecretImport}.id` as "id"]: secretImportDocId }); - if (!secretImportDoc) throw new NotFoundError({ message: "Failed to find secret import" }); + if (!secretImportDoc) throw new BadRequestError({ message: "Failed to find secret import" }); if (!secretImportDoc.isReplication) throw new BadRequestError({ message: "Import is not in replication mode" }); @@ -449,7 +449,7 @@ export const secretImportServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); - if (!folder) throw new NotFoundError({ message: "Folder not found" }); + if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Get imports" }); const secImports = await secretImportDAL.find({ folderId: folder.id, search, limit, offset }); return secImports; @@ -546,9 +546,9 @@ export const secretImportServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const importedSecrets = await fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL }); diff --git a/backend/src/services/secret-sharing/secret-sharing-service.ts b/backend/src/services/secret-sharing/secret-sharing-service.ts index 47eefcf6e..6133db559 100644 --- a/backend/src/services/secret-sharing/secret-sharing-service.ts +++ b/backend/src/services/secret-sharing/secret-sharing-service.ts @@ -45,7 +45,7 @@ export const secretSharingServiceFactory = ({ expiresAfterViews }: TCreateSharedSecretDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - if (!permission) throw new ForbiddenRequestError({ name: "User is not a part of the specified organization" }); + if (!permission) throw new UnauthorizedError({ name: "User not in org" }); if (new Date(expiresAt) < new Date()) { throw new BadRequestError({ message: "Expiration date cannot be in the past" }); @@ -132,7 +132,7 @@ export const secretSharingServiceFactory = ({ offset, limit }: TGetSharedSecretsDTO) => { - if (!actorOrgId) throw new ForbiddenRequestError(); + if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" }); const { permission } = await permissionService.getOrgPermission( actor, @@ -141,7 +141,7 @@ export const secretSharingServiceFactory = ({ actorAuthMethod, actorOrgId ); - if (!permission) throw new ForbiddenRequestError({ name: "User does not belong to the specified organization" }); + if (!permission) throw new UnauthorizedError({ name: "User not in org" }); const secrets = await secretSharingDAL.find( { @@ -191,7 +191,7 @@ export const secretSharingServiceFactory = ({ const orgName = sharedSecret.orgId ? (await orgDAL.findOrgById(sharedSecret.orgId))?.name : ""; if (accessType === SecretSharingAccessType.Organization && orgId !== sharedSecret.orgId) - throw new ForbiddenRequestError(); + throw new UnauthorizedError(); // all secrets pass through here, meaning we check if its expired first and then check if it needs verification // or can be safely sent to the client. @@ -240,7 +240,7 @@ export const secretSharingServiceFactory = ({ const deleteSharedSecretById = async (deleteSharedSecretInput: TDeleteSharedSecretDTO) => { const { actor, actorId, orgId, actorAuthMethod, actorOrgId, sharedSecretId } = deleteSharedSecretInput; const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - if (!permission) throw new ForbiddenRequestError({ name: "User does not belong to the specified organization" }); + if (!permission) throw new UnauthorizedError({ name: "User not in org" }); const deletedSharedSecret = await secretSharingDAL.deleteById(sharedSecretId); return deletedSharedSecret; }; diff --git a/backend/src/services/secret-tag/secret-tag-service.ts b/backend/src/services/secret-tag/secret-tag-service.ts index c4427e75f..dd595f046 100644 --- a/backend/src/services/secret-tag/secret-tag-service.ts +++ b/backend/src/services/secret-tag/secret-tag-service.ts @@ -47,7 +47,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe const updateTag = async ({ actorId, actor, actorOrgId, actorAuthMethod, id, color, slug }: TUpdateTagDTO) => { const tag = await secretTagDAL.findById(id); - if (!tag) throw new NotFoundError({ message: "Tag not found" }); + if (!tag) throw new BadRequestError({ message: "Tag doesn't exist" }); if (slug) { const existingTag = await secretTagDAL.findOne({ slug, projectId: tag.projectId }); @@ -69,7 +69,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe const deleteTag = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TDeleteTagDTO) => { const tag = await secretTagDAL.findById(id); - if (!tag) throw new NotFoundError({ message: "Tag not found" }); + if (!tag) throw new BadRequestError({ message: "Tag doesn't exist" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -86,7 +86,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe const getTagById = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TGetTagByIdDTO) => { const tag = await secretTagDAL.findById(id); - if (!tag) throw new NotFoundError({ message: "Tag not found" }); + if (!tag) throw new NotFoundError({ message: "Tag doesn't exist" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -102,7 +102,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe const getTagBySlug = async ({ actorId, actor, actorOrgId, actorAuthMethod, slug, projectId }: TGetTagBySlugDTO) => { const tag = await secretTagDAL.findOne({ projectId, slug }); - if (!tag) throw new NotFoundError({ message: "Tag not found" }); + if (!tag) throw new NotFoundError({ message: "Tag doesn't exist" }); const { permission } = await permissionService.getProjectPermission( actor, diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts index 1a9397e91..b04915abe 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts @@ -3,7 +3,7 @@ import { validate as uuidValidate } from "uuid"; import { TDbClient } from "@app/db"; import { SecretsV2Schema, SecretType, TableName, TSecretsV2, TSecretsV2Update } from "@app/db/schemas"; -import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, DatabaseError } from "@app/lib/errors"; import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex"; import { OrderByDirection } from "@app/lib/types"; import { SecretsOrderBy } from "@app/services/secret/secret-types"; @@ -61,7 +61,7 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => { ); if (existingSecrets.length !== data.length) { - throw new NotFoundError({ message: "One or more secrets was not found" }); + throw new BadRequestError({ message: "Some of the secrets do not exist" }); } if (data.length === 0) return []; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts index 78e21b579..692e6d33a 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -1,7 +1,7 @@ import path from "node:path"; import { TableName, TSecretFolders, TSecretsV2 } from "@app/db/schemas"; -import { ForbiddenRequestError } from "@app/lib/errors"; +import { UnauthorizedError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; @@ -436,7 +436,7 @@ export const expandSecretReferencesFactory = ({ const [secretKey] = entities; if (!canExpandValue(environment, secretPath)) - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: `You are attempting to reference secret named ${secretKey} from environment ${environment} in path ${secretPath} which you do not have access to.` }); @@ -461,7 +461,7 @@ export const expandSecretReferencesFactory = ({ const secretReferenceKey = entities[entities.length - 1]; if (!canExpandValue(secretReferenceEnvironment, secretReferencePath)) - throw new ForbiddenRequestError({ + throw new UnauthorizedError({ message: `You are attempting to reference secret named ${secretReferenceKey} from environment ${secretReferenceEnvironment} in path ${secretReferencePath} which you do not have access to.` }); diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 6e8d95e1c..c50a5a25a 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -7,7 +7,7 @@ import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-app import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal"; import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { setKnexStringValue } from "@app/lib/knex"; import { logger } from "@app/lib/logger"; @@ -117,7 +117,7 @@ export const secretV2BridgeServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); @@ -144,7 +144,7 @@ export const secretV2BridgeServiceFactory = ({ // validate tags // fetch all tags and if not same count throw error meaning one was invalid tags const tags = inputSecret.tagIds ? await secretTagDAL.find({ projectId, $in: { id: inputSecret.tagIds } }) : []; - if ((inputSecret.tagIds || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if ((inputSecret.tagIds || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const { secretName, type, ...el } = inputSecret; const references = getAllNestedSecretReferences(inputSecret.secretValue); @@ -237,7 +237,7 @@ export const secretV2BridgeServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "UpdateSecret" }); @@ -260,7 +260,7 @@ export const secretV2BridgeServiceFactory = ({ folderId, userId: actorId }); - if (!personalSecretToModify) throw new NotFoundError({ message: "Secret not found" }); + if (!personalSecretToModify) throw new BadRequestError({ message: "Secret not found" }); secretId = personalSecretToModify.id; secret = personalSecretToModify; } else { @@ -269,7 +269,7 @@ export const secretV2BridgeServiceFactory = ({ type: SecretType.Shared, folderId }); - if (!sharedSecretToModify) throw new NotFoundError({ message: "Secret not found" }); + if (!sharedSecretToModify) throw new BadRequestError({ message: "Secret not found" }); secretId = sharedSecretToModify.id; secret = sharedSecretToModify; } @@ -286,7 +286,7 @@ export const secretV2BridgeServiceFactory = ({ // validate tags // fetch all tags and if not same count throw error meaning one was invalid tags const tags = inputSecret.tagIds ? await secretTagDAL.find({ projectId, $in: { id: inputSecret.tagIds } }) : []; - if ((inputSecret.tagIds || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if ((inputSecret.tagIds || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const { secretName, secretValue } = inputSecret; @@ -388,7 +388,7 @@ export const secretV2BridgeServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Delete secret" }); @@ -792,7 +792,7 @@ export const secretV2BridgeServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); @@ -878,7 +878,7 @@ export const secretV2BridgeServiceFactory = ({ } } } - if (!secret) throw new NotFoundError({ message: "Secret not found" }); + if (!secret) throw new BadRequestError({ message: "Secret not found" }); let secretValue = secret.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString() @@ -927,7 +927,7 @@ export const secretV2BridgeServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); @@ -946,7 +946,7 @@ export const secretV2BridgeServiceFactory = ({ // get all tags const sanitizedTagIds = inputSecrets.flatMap(({ tagIds = [] }) => tagIds); const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; - if (tags.length !== sanitizedTagIds.length) throw new NotFoundError({ message: "Tag not found" }); + if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId }); @@ -1032,7 +1032,7 @@ export const secretV2BridgeServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Update secret" }); @@ -1046,7 +1046,7 @@ export const secretV2BridgeServiceFactory = ({ })) ); if (secretsToUpdate.length !== inputSecrets.length) - throw new NotFoundError({ message: `Secret does not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); const secretsToUpdateInDBGroupedByKey = groupBy(secretsToUpdate, (i) => i.key); // now find any secret that needs to update its name @@ -1062,14 +1062,14 @@ export const secretV2BridgeServiceFactory = ({ ); if (secrets.length) throw new BadRequestError({ - message: `Secret with new name already exists: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}` + message: `Secret with new name exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}` }); } // get all tags const sanitizedTagIds = inputSecrets.flatMap(({ tagIds = [] }) => tagIds); const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; - if (tags.length !== sanitizedTagIds.length) throw new NotFoundError({ message: "Tag not found" }); + if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId }); @@ -1164,7 +1164,7 @@ export const secretV2BridgeServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); @@ -1178,9 +1178,7 @@ export const secretV2BridgeServiceFactory = ({ })) ); if (secretsToDelete.length !== inputSecrets.length) - throw new NotFoundError({ - message: `One or more secrets does not exist: ${secretsToDelete.map((el) => el.key).join(",")}` - }); + throw new BadRequestError({ message: `Secret not exist: ${secretsToDelete.map((el) => el.key).join(",")}` }); const secretsDeleted = await secretDAL.transaction(async (tx) => fnSecretBulkDelete({ @@ -1229,10 +1227,10 @@ export const secretV2BridgeServiceFactory = ({ secretId }: TGetSecretVersionsDTO) => { const secret = await secretDAL.findById(secretId); - if (!secret) throw new NotFoundError({ message: "Failed to find secret" }); + if (!secret) throw new BadRequestError({ message: "Failed to find secret" }); const folder = await folderDAL.findById(secret.folderId); - if (!folder) throw new NotFoundError({ message: "Failed to find secret" }); + if (!folder) throw new BadRequestError({ message: "Failed to find secret" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -1275,7 +1273,7 @@ export const secretV2BridgeServiceFactory = ({ ); if (!hasRole(ProjectMembershipRole.Admin)) - throw new ForbiddenRequestError({ message: "Only admins are allowed to take this action" }); + throw new BadRequestError({ message: "Only admins are allowed to take this action" }); const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, diff --git a/backend/src/services/secret/secret-dal.ts b/backend/src/services/secret/secret-dal.ts index 0d4ae0cda..290a9597a 100644 --- a/backend/src/services/secret/secret-dal.ts +++ b/backend/src/services/secret/secret-dal.ts @@ -3,7 +3,7 @@ import { validate as uuidValidate } from "uuid"; import { TDbClient } from "@app/db"; import { SecretsSchema, SecretType, TableName, TSecrets, TSecretsUpdate } from "@app/db/schemas"; -import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, DatabaseError } from "@app/lib/errors"; import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex"; export type TSecretDALFactory = ReturnType; @@ -55,7 +55,7 @@ export const secretDALFactory = (db: TDbClient) => { ); if (existingSecrets.length !== data.length) { - throw new NotFoundError({ message: "Some of the secrets do not exist" }); + throw new BadRequestError({ message: "Some of the secrets do not exist" }); } if (data.length === 0) return []; diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index ce7507f44..e77972d37 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -19,7 +19,7 @@ import { decryptSymmetric128BitHexKeyUTF8, encryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { groupBy, unique } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; import { @@ -498,7 +498,7 @@ export const fnSecretBlindIndexCheck = async ({ const hasUnknownSecretsProvided = secretKeysInDB.length !== inputSecrets.length; if (hasUnknownSecretsProvided) { const keysMissingInDB = Object.keys(keyName2BlindIndex).filter((key) => !secretKeysInDB.includes(key)); - throw new NotFoundError({ + throw new BadRequestError({ message: `Secret not found: blind index ${keysMissingInDB.join(",")}` }); } @@ -757,7 +757,7 @@ export const createManySecretsRawFnFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); @@ -798,7 +798,7 @@ export const createManySecretsRawFnFactory = ({ // get all tags const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tags.length !== tagIds.length) throw new NotFoundError({ message: "Tag not found" }); + if (tags.length !== tagIds.length) throw new BadRequestError({ message: "Tag not found" }); const newSecrets = await secretDAL.transaction(async (tx) => fnSecretV2BridgeBulkInsert({ @@ -820,7 +820,7 @@ export const createManySecretsRawFnFactory = ({ } const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Create secret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Create secret" }); // insert operation const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({ @@ -833,9 +833,9 @@ export const createManySecretsRawFnFactory = ({ }); if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const inputSecrets = secrets.map((secret) => { const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secret.secretName, botKey); @@ -865,7 +865,7 @@ export const createManySecretsRawFnFactory = ({ // get all tags const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tags.length !== tagIds.length) throw new NotFoundError({ message: "Tag not found" }); + if (tags.length !== tagIds.length) throw new BadRequestError({ message: "Tag not found" }); const newSecrets = await secretDAL.transaction(async (tx) => fnSecretBulkInsert({ @@ -917,7 +917,7 @@ export const updateManySecretsRawFnFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Update secret" }); @@ -936,7 +936,7 @@ export const updateManySecretsRawFnFactory = ({ })) ); if (secretsToUpdate.length !== secrets.length) - throw new NotFoundError({ message: `Secret does not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); // now find any secret that needs to update its name // same process as above @@ -950,8 +950,8 @@ export const updateManySecretsRawFnFactory = ({ })) ); if (secretsWithNewNameInDB.length) - throw new NotFoundError({ - message: `Secret does not exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}` + throw new BadRequestError({ + message: `Secret not exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}` }); } @@ -977,7 +977,7 @@ export const updateManySecretsRawFnFactory = ({ const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const updatedSecrets = await secretDAL.transaction(async (tx) => fnSecretV2BridgeBulkUpdate({ @@ -998,12 +998,12 @@ export const updateManySecretsRawFnFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Update secret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" }); const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({ inputSecrets: secrets, @@ -1046,7 +1046,7 @@ export const updateManySecretsRawFnFactory = ({ const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); // now find any secret that needs to update its name // same process as above diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index 800150a77..ce9c58391 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -18,7 +18,7 @@ import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/ import { getConfig } from "@app/lib/config/env"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; import { daysToMillisecond, secondsToMillis } from "@app/lib/dates"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { getTimeDifferenceInSeconds, groupBy, isSamePath, unique } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue"; @@ -1028,7 +1028,7 @@ export const secretQueueFactory = ({ if (isProjectUpgradedToV3 || project.upgradeStatus === ProjectUpgradeStatus.InProgress) { return; } - if (!botKey) throw new NotFoundError({ message: "Project bot not found" }); + if (!botKey) throw new BadRequestError({ message: "Bot not found" }); await projectDAL.updateById(projectId, { upgradeStatus: ProjectUpgradeStatus.InProgress }); const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index b4eade55d..566598238 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -23,7 +23,7 @@ import { decryptSymmetric128BitHexKeyUTF8, encryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { groupBy, pick } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; @@ -153,7 +153,7 @@ export const secretServiceFactory = ({ const appCfg = getConfig(); const secretBlindIndexDoc = await secretBlindIndexDAL.findOne({ projectId }); - if (!secretBlindIndexDoc) throw new NotFoundError({ message: "Blind index not found", name: "Create secret" }); + if (!secretBlindIndexDoc) throw new BadRequestError({ message: "Blind index not found", name: "Create secret" }); const secretBlindIndex = await buildSecretBlindIndexFromName({ secretName, @@ -164,7 +164,7 @@ export const secretServiceFactory = ({ ciphertext: secretBlindIndexDoc.encryptedSaltCipherText, iv: secretBlindIndexDoc.saltIV }); - if (!secretBlindIndex) throw new NotFoundError({ message: "Secret not found" }); + if (!secretBlindIndex) throw new BadRequestError({ message: "Secret not found" }); return secretBlindIndex; }; @@ -194,14 +194,14 @@ export const secretServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); const folderId = folder.id; const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" }); if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) { throw new BadRequestError({ message: "Must be user to create personal secret" }); @@ -232,7 +232,7 @@ export const secretServiceFactory = ({ // validate tags // fetch all tags and if not same count throw error meaning one was invalid tags const tags = inputSecret.tags ? await secretTagDAL.findManyTagsById(projectId, inputSecret.tags) : []; - if ((inputSecret.tags || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if ((inputSecret.tags || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const { secretName, type, ...el } = inputSecret; const references = await getSecretReference(projectId); @@ -305,14 +305,14 @@ export const secretServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); const folderId = folder.id; const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" }); if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) { throw new BadRequestError({ message: "Must be user to create personal secret" }); @@ -352,7 +352,7 @@ export const secretServiceFactory = ({ }); const tags = inputSecret.tags ? await secretTagDAL.findManyTagsById(projectId, inputSecret.tags) : []; - if ((inputSecret.tags || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if ((inputSecret.tags || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const { secretName, ...el } = inputSecret; @@ -436,14 +436,14 @@ export const secretServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); const folderId = folder.id; const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" }); if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) { throw new BadRequestError({ message: "Must be user to create personal secret" }); @@ -617,7 +617,7 @@ export const secretServiceFactory = ({ ); const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); @@ -688,7 +688,7 @@ export const secretServiceFactory = ({ } } } - if (!secret) throw new NotFoundError({ message: "Secret not found" }); + if (!secret) throw new BadRequestError({ message: "Secret not found" }); return { ...secret, workspace: projectId, environment, secretPath: path }; }; @@ -719,14 +719,14 @@ export const secretServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); const folderId = folder.id; const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Create secret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Create secret" }); const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({ inputSecrets, @@ -739,7 +739,7 @@ export const secretServiceFactory = ({ // get all tags const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tags.length !== tagIds.length) throw new NotFoundError({ message: "Tag not found" }); + if (tags.length !== tagIds.length) throw new BadRequestError({ message: "Tag not found" }); const references = await getSecretReference(projectId); const newSecrets = await secretDAL.transaction(async (tx) => @@ -804,14 +804,14 @@ export const secretServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Update secret" }); const folderId = folder.id; const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Update secret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" }); const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({ inputSecrets, @@ -835,7 +835,7 @@ export const secretServiceFactory = ({ // get all tags const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; - if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" }); + if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); const references = await getSecretReference(projectId); const secrets = await secretDAL.transaction(async (tx) => @@ -910,14 +910,14 @@ export const secretServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environment, path); if (!folder) - throw new NotFoundError({ + throw new BadRequestError({ message: "Folder not found for the given environment slug & secret path", name: "Create secret" }); const folderId = folder.id; const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); - if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Update secret" }); + if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" }); const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({ inputSecrets, @@ -981,7 +981,7 @@ export const secretServiceFactory = ({ if (!shouldUseSecretV2Bridge) throw new BadRequestError({ message: "Project version does not support pagination", - name: "PaginationNotSupportedError" + name: "pagination_not_supported" }); const count = await secretV2BridgeService.getSecretsCount({ @@ -1017,7 +1017,7 @@ export const secretServiceFactory = ({ if (!shouldUseSecretV2Bridge) throw new BadRequestError({ message: "Project version does not support pagination", - name: "PaginationNotSupportedError" + name: "pagination_not_supported" }); const count = await secretV2BridgeService.getSecretsCountMultiEnv({ @@ -1052,7 +1052,7 @@ export const secretServiceFactory = ({ if (!shouldUseSecretV2Bridge) throw new BadRequestError({ message: "Project version does not support pagination", - name: "PaginationNotSupportError" + name: "pagination_not_supported" }); const secrets = await secretV2BridgeService.getSecretsMultiEnv({ @@ -1103,9 +1103,9 @@ export const secretServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const { secrets, imports } = await getSecrets({ @@ -1267,9 +1267,9 @@ export const secretServiceFactory = ({ }); if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const decryptedSecret = decryptSecretRaw(encryptedSecret, botKey); @@ -1363,9 +1363,9 @@ export const secretServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretName, botKey); const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); @@ -1505,9 +1505,9 @@ export const secretServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); @@ -1631,9 +1631,9 @@ export const secretServiceFactory = ({ return { type: SecretProtectionType.Direct as const, secret }; } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); if (policy) { const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ @@ -1688,7 +1688,7 @@ export const secretServiceFactory = ({ // pick either project slug or projectid if (!optionalProjectId && projectSlug) { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); projectId = project.id; } @@ -1735,9 +1735,9 @@ export const secretServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const sanitizedSecrets = inputSecrets.map( ({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => { @@ -1815,7 +1815,7 @@ export const secretServiceFactory = ({ let projectId = optionalProjectId as string; if (!optionalProjectId && projectSlug) { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); projectId = project.id; } @@ -1861,9 +1861,9 @@ export const secretServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); const sanitizedSecrets = inputSecrets.map( ({ @@ -1953,7 +1953,7 @@ export const secretServiceFactory = ({ let projectId = optionalProjectId as string; if (!optionalProjectId && projectSlug) { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new NotFoundError({ message: "Project not found" }); + if (!project) throw new BadRequestError({ message: "Project not found" }); projectId = project.id; } @@ -1993,9 +1993,9 @@ export const secretServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); if (policy) { @@ -2060,12 +2060,12 @@ export const secretServiceFactory = ({ if (secretVersionV2) return secretVersionV2; const secret = await secretDAL.findById(secretId); - if (!secret) throw new NotFoundError({ message: "Failed to find secret" }); + if (!secret) throw new BadRequestError({ message: "Failed to find secret" }); const folder = await folderDAL.findById(secret.folderId); - if (!folder) throw new NotFoundError({ message: "Failed to find secret" }); + if (!folder) throw new BadRequestError({ message: "Failed to find secret" }); const { botKey } = await projectBotService.getBotKey(folder.projectId); - if (!botKey) throw new NotFoundError({ message: "Project bot not found" }); + if (!botKey) throw new BadRequestError({ message: "bot not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -2130,12 +2130,12 @@ export const secretServiceFactory = ({ }); if (!secret) { - throw new NotFoundError({ message: "Secret not found" }); + throw new BadRequestError({ message: "Secret not found" }); } const folder = await folderDAL.findBySecretPath(project.id, environment, secretPath); if (!folder) { - throw new NotFoundError({ message: "Folder not found" }); + throw new BadRequestError({ message: "Folder not found" }); } const tags = await secretTagDAL.find({ @@ -2146,7 +2146,7 @@ export const secretServiceFactory = ({ }); if (tags.length !== tagSlugs.length) { - throw new NotFoundError({ message: "One or more tags not found." }); + throw new BadRequestError({ message: "One or more tags not found." }); } const existingSecretTags = await secretDAL.getSecretTags(secret.id); @@ -2232,12 +2232,12 @@ export const secretServiceFactory = ({ }); if (!secret) { - throw new NotFoundError({ message: "Secret not found" }); + throw new BadRequestError({ message: "Secret not found" }); } const folder = await folderDAL.findBySecretPath(project.id, environment, secretPath); if (!folder) { - throw new NotFoundError({ message: "Folder not found" }); + throw new BadRequestError({ message: "Folder not found" }); } const tags = await secretTagDAL.find({ @@ -2248,7 +2248,7 @@ export const secretServiceFactory = ({ }); if (tags.length !== tagSlugs.length) { - throw new NotFoundError({ message: "One or more tags not found." }); + throw new BadRequestError({ message: "One or more tags not found." }); } const existingSecretTags = await secretDAL.getSecretTags(secret.id); @@ -2258,7 +2258,7 @@ export const secretServiceFactory = ({ const secretTagIds = existingSecretTags.map((tag) => tag.id); if (!tagIdsToRemove.every((el) => secretTagIds.includes(el))) { - throw new NotFoundError({ message: "One or more tags not found on the secret" }); + throw new BadRequestError({ message: "One or more tags not found on the secret" }); } const newTags = existingSecretTags.filter((tag) => !tagIdsToRemove.includes(tag.id)); @@ -2316,7 +2316,7 @@ export const secretServiceFactory = ({ ); if (!hasRole(ProjectMembershipRole.Admin)) - throw new ForbiddenRequestError({ message: "Only admins are allowed to take this action" }); + throw new BadRequestError({ message: "Only admins are allowed to take this action" }); const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); if (shouldUseSecretV2Bridge) { @@ -2330,9 +2330,9 @@ export const secretServiceFactory = ({ } if (!botKey) - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); await secretDAL.transaction(async (tx) => { @@ -2416,9 +2416,9 @@ export const secretServiceFactory = ({ const { botKey } = await projectBotService.getBotKey(project.id); if (!botKey) { - throw new NotFoundError({ + throw new BadRequestError({ message: "Project bot not found. Please upgrade your project.", - name: "BotNotFoundError" + name: "bot_not_found_error" }); } @@ -2777,12 +2777,12 @@ export const secretServiceFactory = ({ ); if (!hasRole(ProjectMembershipRole.Admin)) - throw new ForbiddenRequestError({ message: "Only admins are allowed to take this action" }); + throw new BadRequestError({ message: "Only admins are allowed to take this action" }); const { shouldUseSecretV2Bridge: isProjectV3, project } = await projectBotService.getBotKey(projectId); - if (isProjectV3) throw new BadRequestError({ message: "Project is already V3" }); + if (isProjectV3) throw new BadRequestError({ message: "project is already in v3" }); if (project.upgradeStatus === ProjectUpgradeStatus.InProgress) - throw new BadRequestError({ message: "Project is already being upgraded" }); + throw new BadRequestError({ message: "project is upgrading" }); await secretQueueService.startSecretV2Migration(projectId); return { message: "Migrating project to new KMS architecture" }; diff --git a/backend/src/services/secret/secret-version-dal.ts b/backend/src/services/secret/secret-version-dal.ts index 394cecab0..cb04211d5 100644 --- a/backend/src/services/secret/secret-version-dal.ts +++ b/backend/src/services/secret/secret-version-dal.ts @@ -2,7 +2,7 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { TableName, TSecretVersions, TSecretVersionsUpdate } from "@app/db/schemas"; -import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, DatabaseError } from "@app/lib/errors"; import { ormify, selectAllTableCols } from "@app/lib/knex"; import { logger } from "@app/lib/logger"; import { QueueName } from "@app/queue"; @@ -72,7 +72,7 @@ export const secretVersionDALFactory = (db: TDbClient) => { ); if (existingSecretVersions.length !== data.length) { - throw new NotFoundError({ message: "Some of the secret versions do not exist" }); + throw new BadRequestError({ message: "Some of the secret versions do not exist" }); } if (data.length === 0) return []; diff --git a/backend/src/services/service-token/service-token-service.ts b/backend/src/services/service-token/service-token-service.ts index 1487d9380..796e63abd 100644 --- a/backend/src/services/service-token/service-token-service.ts +++ b/backend/src/services/service-token/service-token-service.ts @@ -6,7 +6,7 @@ import bcrypt from "bcrypt"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { getConfig } from "@app/lib/config/env"; -import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { TAccessTokenQueueServiceFactory } from "../access-token-queue/access-token-queue"; import { ActorType } from "../auth/auth-type"; @@ -75,7 +75,7 @@ export const serviceTokenServiceFactory = ({ // validates env const scopeEnvs = [...new Set(scopes.map(({ environment }) => environment))]; const inputEnvs = await projectEnvDAL.findBySlugs(projectId, scopeEnvs); - if (inputEnvs.length !== scopeEnvs.length) throw new NotFoundError({ message: "Environment not found" }); + if (inputEnvs.length !== scopeEnvs.length) throw new BadRequestError({ message: "Environment not found" }); const secret = crypto.randomBytes(16).toString("hex"); const secretHash = await bcrypt.hash(secret, appCfg.SALT_ROUNDS); @@ -106,7 +106,7 @@ export const serviceTokenServiceFactory = ({ const deleteServiceToken = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TDeleteServiceTokenDTO) => { const serviceToken = await serviceTokenDAL.findById(id); - if (!serviceToken) throw new NotFoundError({ message: "Token not found" }); + if (!serviceToken) throw new BadRequestError({ message: "Token not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -122,13 +122,13 @@ export const serviceTokenServiceFactory = ({ }; const getServiceToken = async ({ actor, actorId }: TGetServiceTokenInfoDTO) => { - if (actor !== ActorType.SERVICE) throw new NotFoundError({ message: "Service token not found" }); + if (actor !== ActorType.SERVICE) throw new BadRequestError({ message: "Service token not found" }); const serviceToken = await serviceTokenDAL.findById(actorId); - if (!serviceToken) throw new NotFoundError({ message: "Token not found" }); + if (!serviceToken) throw new BadRequestError({ message: "Token not found" }); const serviceTokenUser = await userDAL.findById(serviceToken.createdBy); - if (!serviceTokenUser) throw new NotFoundError({ message: "Service token user not found" }); + if (!serviceTokenUser) throw new BadRequestError({ message: "Service token user not found" }); return { serviceToken, user: serviceTokenUser }; }; @@ -154,21 +154,21 @@ export const serviceTokenServiceFactory = ({ }; const fnValidateServiceToken = async (token: string) => { - const [, tokenIdentifier, tokenSecret] = <[string, string, string]>token.split(".", 3); - const serviceToken = await serviceTokenDAL.findById(tokenIdentifier); + const [, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>token.split(".", 3); + const serviceToken = await serviceTokenDAL.findById(TOKEN_IDENTIFIER); - if (!serviceToken) throw new NotFoundError({ message: "Service token not found" }); + if (!serviceToken) throw new UnauthorizedError(); const project = await projectDAL.findById(serviceToken.projectId); - if (!project) throw new NotFoundError({ message: "Service token project not found" }); + if (!project) throw new UnauthorizedError({ message: "Service token project not found" }); if (serviceToken.expiresAt && new Date(serviceToken.expiresAt) < new Date()) { await serviceTokenDAL.deleteById(serviceToken.id); - throw new ForbiddenRequestError({ message: "Service token has expired" }); + throw new UnauthorizedError({ message: "failed to authenticate expired service token" }); } - const isMatch = await bcrypt.compare(tokenSecret, serviceToken.secretHash); - if (!isMatch) throw new ForbiddenRequestError(); + const isMatch = await bcrypt.compare(TOKEN_SECRET, serviceToken.secretHash); + if (!isMatch) throw new UnauthorizedError(); await accessTokenQueue.updateServiceTokenStatus(serviceToken.id); return { ...serviceToken, lastUsed: new Date(), orgId: project.orgId }; diff --git a/backend/src/services/super-admin/super-admin-service.ts b/backend/src/services/super-admin/super-admin-service.ts index b4f77df05..9fe8d7501 100644 --- a/backend/src/services/super-admin/super-admin-service.ts +++ b/backend/src/services/super-admin/super-admin-service.ts @@ -54,7 +54,7 @@ export const superAdminServiceFactory = ({ const serverCfg = await serverCfgDAL.findById(ADMIN_CONFIG_DB_UUID); if (!serverCfg) { - throw new NotFoundError({ message: "Admin config not found" }); + throw new BadRequestError({ name: "Admin config", message: "Admin config not found" }); } await keyStore.setItemWithExpiry(ADMIN_CONFIG_KEY, ADMIN_CONFIG_KEY_EXP, JSON.stringify(serverCfg)); // insert it back to keystore @@ -167,7 +167,7 @@ export const superAdminServiceFactory = ({ }: TAdminSignUpDTO) => { const appCfg = getConfig(); const existingUser = await userDAL.findOne({ email }); - if (existingUser) throw new BadRequestError({ name: "Admin sign up", message: "User already exists" }); + if (existingUser) throw new BadRequestError({ name: "Admin sign up", message: "User already exist" }); const privateKey = await getUserPrivateKey(password, { encryptionVersion: 2, diff --git a/backend/src/services/user/user-service.ts b/backend/src/services/user/user-service.ts index bdf73dd74..8d7d1ffbe 100644 --- a/backend/src/services/user/user-service.ts +++ b/backend/src/services/user/user-service.ts @@ -4,7 +4,7 @@ import { SecretKeyEncoding } from "@app/db/schemas"; import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; -import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service"; import { TokenType } from "@app/services/auth-token/auth-token-types"; import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal"; @@ -55,7 +55,7 @@ export const userServiceFactory = ({ }: TUserServiceFactoryDep) => { const sendEmailVerificationCode = async (username: string) => { const user = await userDAL.findOne({ username }); - if (!user) throw new NotFoundError({ name: "Failed to find user" }); + if (!user) throw new BadRequestError({ name: "Failed to find user" }); if (!user.email) throw new BadRequestError({ name: "Failed to send email verification code due to no email on user" }); if (user.isEmailVerified) @@ -78,7 +78,7 @@ export const userServiceFactory = ({ const verifyEmailVerificationCode = async (username: string, code: string) => { const user = await userDAL.findOne({ username }); - if (!user) throw new NotFoundError({ name: "Failed to find user" }); + if (!user) throw new BadRequestError({ name: "Failed to find user" }); if (!user.email) throw new BadRequestError({ name: "Failed to verify email verification code due to no email on user" }); if (user.isEmailVerified) @@ -113,7 +113,7 @@ export const userServiceFactory = ({ if (users.length > 1) { // merge users const mergeUser = users.find((u) => u.id !== user.id); - if (!mergeUser) throw new NotFoundError({ name: "Failed to find merge user" }); + if (!mergeUser) throw new BadRequestError({ name: "Failed to find merge user" }); const mergeUserOrgMembershipSet = new Set( (await orgMembershipDAL.find({ userId: mergeUser.id }, { tx })).map((m) => m.orgId) @@ -193,11 +193,13 @@ export const userServiceFactory = ({ const updateAuthMethods = async (userId: string, authMethods: AuthMethod[]) => { const user = await userDAL.findById(userId); - if (!user) throw new NotFoundError({ message: "User not found" }); + if (!user) throw new BadRequestError({ name: "Update auth methods" }); - if (user.authMethods?.includes(AuthMethod.LDAP) || authMethods.includes(AuthMethod.LDAP)) { + if (user.authMethods?.includes(AuthMethod.LDAP)) + throw new BadRequestError({ message: "LDAP auth method cannot be updated", name: "Update auth methods" }); + + if (authMethods.includes(AuthMethod.LDAP)) throw new BadRequestError({ message: "LDAP auth method cannot be updated", name: "Update auth methods" }); - } const updatedUser = await userDAL.updateById(userId, { authMethods }); return updatedUser; @@ -205,7 +207,7 @@ export const userServiceFactory = ({ const getMe = async (userId: string) => { const user = await userDAL.findUserEncKeyByUserId(userId); - if (!user) throw new NotFoundError({ message: "User not found" }); + if (!user) throw new BadRequestError({ message: "user not found", name: "Get Me" }); return user; }; @@ -246,7 +248,7 @@ export const userServiceFactory = ({ const getUserPrivateKey = async (userId: string) => { const user = await userDAL.findUserEncKeyByUserId(userId); if (!user?.serverEncryptedPrivateKey || !user.serverEncryptedPrivateKeyIV || !user.serverEncryptedPrivateKeyTag) { - throw new NotFoundError({ message: "Private key not found. Please login again" }); + throw new BadRequestError({ message: "Private key not found. Please login again" }); } const privateKey = infisicalSymmetricDecrypt({ ciphertext: user.serverEncryptedPrivateKey, @@ -265,7 +267,7 @@ export const userServiceFactory = ({ }); if (!orgMembership) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "User does not belong in the organization." }); } @@ -280,7 +282,7 @@ export const userServiceFactory = ({ }); if (!orgMembership) { - throw new ForbiddenRequestError({ + throw new BadRequestError({ message: "User does not belong in the organization." }); } diff --git a/backend/src/services/webhook/webhook-fns.ts b/backend/src/services/webhook/webhook-fns.ts index 151c69632..4690edba9 100644 --- a/backend/src/services/webhook/webhook-fns.ts +++ b/backend/src/services/webhook/webhook-fns.ts @@ -6,7 +6,7 @@ import picomatch from "picomatch"; import { SecretKeyEncoding, TWebhooks } from "@app/db/schemas"; import { request } from "@app/lib/config/request"; import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { TProjectDALFactory } from "../project/project-dal"; @@ -172,7 +172,7 @@ export const fnTriggerWebhook = async ({ await webhookDAL.transaction(async (tx) => { const env = await projectEnvDAL.findOne({ projectId, slug: environment }, tx); - if (!env) throw new NotFoundError({ message: "Environment not found" }); + if (!env) throw new BadRequestError({ message: "Env not found" }); if (successWebhooks.length) { await webhookDAL.update( { envId: env.id, $in: { id: successWebhooks } }, diff --git a/backend/src/services/webhook/webhook-service.ts b/backend/src/services/webhook/webhook-service.ts index 0bf72d56e..41dacd34b 100644 --- a/backend/src/services/webhook/webhook-service.ts +++ b/backend/src/services/webhook/webhook-service.ts @@ -4,7 +4,7 @@ import { TWebhooksInsert } from "@app/db/schemas"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; -import { NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { TProjectDALFactory } from "../project/project-dal"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; @@ -54,7 +54,7 @@ export const webhookServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Webhooks); const env = await projectEnvDAL.findOne({ projectId, slug: environment }); - if (!env) throw new NotFoundError({ message: "Environment not found" }); + if (!env) throw new BadRequestError({ message: "Env not found" }); const insertDoc: TWebhooksInsert = { url: "", // deprecated - we are moving away from plaintext URLs @@ -88,7 +88,7 @@ export const webhookServiceFactory = ({ const updateWebhook = async ({ actorId, actor, actorOrgId, actorAuthMethod, id, isDisabled }: TUpdateWebhookDTO) => { const webhook = await webhookDAL.findById(id); - if (!webhook) throw new NotFoundError({ message: "Webhook not found" }); + if (!webhook) throw new BadRequestError({ message: "Webhook not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -105,7 +105,7 @@ export const webhookServiceFactory = ({ const deleteWebhook = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TDeleteWebhookDTO) => { const webhook = await webhookDAL.findById(id); - if (!webhook) throw new NotFoundError({ message: "Webhook not found" }); + if (!webhook) throw new BadRequestError({ message: "Webhook not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -122,7 +122,7 @@ export const webhookServiceFactory = ({ const testWebhook = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TTestWebhookDTO) => { const webhook = await webhookDAL.findById(id); - if (!webhook) throw new NotFoundError({ message: "Webhook not found" }); + if (!webhook) throw new BadRequestError({ message: "Webhook not found" }); const { permission } = await permissionService.getProjectPermission( actor,