requested changes

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -9,7 +9,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -81,7 +81,7 @@ export const identityAwsAuthServiceFactory = ({
         .some((accountId) => accountId === Account);
 
       if (!isAccountAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: AWS account ID not allowed."
         });
     }
@@ -100,7 +100,7 @@ export const identityAwsAuthServiceFactory = ({
         });
 
       if (!isArnAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: AWS principal ARN not allowed."
         });
     }

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -73,7 +73,7 @@ export const identityAzureAuthServiceFactory = ({
         .map((servicePrincipalId) => servicePrincipalId.trim())
         .some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid);
 
-      if (!isServicePrincipalAllowed) throw new ForbiddenRequestError({ message: "Service principal not allowed" });
+      if (!isServicePrincipalAllowed) throw new UnauthorizedError({ message: "Service principal not allowed" });
     }
 
     const identityAccessToken = await identityAzureAuthDAL.transaction(async (tx) => {
@@ -314,8 +314,7 @@ export const identityAzureAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
-    if (!hasPriviledge)
       throw new ForbiddenRequestError({
         message: "Failed to revoke azure auth of identity with more privileged role"
       });

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -86,7 +86,7 @@ export const identityGcpAuthServiceFactory = ({
         .some((serviceAccount) => serviceAccount === gcpIdentityDetails.email);
 
       if (!isServiceAccountAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: GCP service account not allowed."
         });
     }
@@ -100,7 +100,7 @@ export const identityGcpAuthServiceFactory = ({
         .some((project) => project === gcpIdentityDetails.computeEngineDetails?.project_id);
 
       if (!isProjectAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: GCP project not allowed."
         });
     }
@@ -112,7 +112,7 @@ export const identityGcpAuthServiceFactory = ({
         .some((zone) => zone === gcpIdentityDetails.computeEngineDetails?.zone);
 
       if (!isZoneAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: GCP zone not allowed."
         });
     }
@@ -359,8 +359,7 @@ export const identityGcpAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
-    if (!hasPriviledge)
       throw new ForbiddenRequestError({
         message: "Failed to revoke gcp auth of identity with more privileged role"
       });

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -132,7 +132,7 @@ export const identityKubernetesAuthServiceFactory = ({
 
     // check the response to determine if the token is valid
     if (!(data.status && data.status.authenticated))
-      throw new ForbiddenRequestError({ message: "Kubernetes token not authenticated" });
+      throw new UnauthorizedError({ message: "Kubernetes token not authenticated" });
 
     const { namespace: targetNamespace, name: targetName } = extractK8sUsername(data.status.user.username);
 
@@ -145,7 +145,7 @@ export const identityKubernetesAuthServiceFactory = ({
         .some((namespace) => namespace === targetNamespace);
 
       if (!isNamespaceAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: K8s namespace not allowed."
         });
     }
@@ -159,7 +159,7 @@ export const identityKubernetesAuthServiceFactory = ({
         .some((name) => name === targetName);
 
       if (!isNameAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: K8s name not allowed."
         });
     }
@@ -171,7 +171,7 @@ export const identityKubernetesAuthServiceFactory = ({
       );
 
       if (!isAudienceAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: K8s audience not allowed."
         });
     }

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -148,7 +148,7 @@ export const identityOidcAuthServiceFactory = ({
           .split(", ")
           .some((policyValue) => doesFieldValueMatchOidcPolicy(tokenData.aud, policyValue))
       ) {
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: OIDC audience not allowed."
         });
       }
@@ -161,7 +161,7 @@ export const identityOidcAuthServiceFactory = ({
         if (
           !claimValue.split(", ").some((claimEntry) => doesFieldValueMatchOidcPolicy(tokenData[claimKey], claimEntry))
         ) {
-          throw new ForbiddenRequestError({
+          throw new UnauthorizedError({
             message: "Access denied: OIDC claim not allowed."
           });
         }
@@ -532,8 +532,7 @@ export const identityOidcAuthServiceFactory = ({
       actorOrgId
     );
 
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!isAtLeastAsPrivileged(permission, rolePermission)) {
-    if (!hasPriviledge) {
       throw new ForbiddenRequestError({
         message: "Failed to revoke OIDC auth of identity with more privileged role"
       });

backend/src/services/identity-ua/identity-ua-service.ts

@@ -88,7 +88,7 @@ export const identityUaServiceFactory = ({
           isClientSecretRevoked: true
         });
 
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied due to expired client secret"
         });
       }
@@ -100,7 +100,7 @@ export const identityUaServiceFactory = ({
       await identityUaClientSecretDAL.updateById(validClientSecretInfo.id, {
         isClientSecretRevoked: true
       });
-      throw new ForbiddenRequestError({
+      throw new UnauthorizedError({
         message: "Access denied due to client secret usage limit reached"
       });
     }
@@ -368,8 +368,7 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
-    if (!hasPriviledge)
       throw new ForbiddenRequestError({
         message: "Failed to revoke universal auth of identity with more privileged role"
       });
@@ -474,8 +473,8 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+
-    if (!hasPriviledge)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to add identity to project with more privileged role"
       });
@@ -521,8 +520,7 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
-    if (!hasPriviledge)
       throw new ForbiddenRequestError({
         message: "Failed to read identity client secret of project with more privileged role"
       });
@@ -561,8 +559,8 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+
-    if (!hasPriviledge)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to revoke identity client secret with more privileged role"
       });