From 84d505bbb0f5e4bd5a8ce1250236d704e9385584 Mon Sep 17 00:00:00 2001
From: Victor Santos <victor@infisical.com>
Date: Mon, 17 Nov 2025 09:36:57 -0300
Subject: [PATCH] refactor: improve error handling for gateway connection in
 LDAP functions

---
 .../ldap/ldap-connection-fns.ts               | 74 ++++++++++---------
 1 file changed, 38 insertions(+), 36 deletions(-)

diff --git a/backend/src/services/app-connection/ldap/ldap-connection-fns.ts b/backend/src/services/app-connection/ldap/ldap-connection-fns.ts
index eb11e8459..961dcff59 100644
--- a/backend/src/services/app-connection/ldap/ldap-connection-fns.ts
+++ b/backend/src/services/app-connection/ldap/ldap-connection-fns.ts
@@ -124,43 +124,45 @@ export const executeWithPotentialGateway = async <T>(
       targetPort: port
     });
 
-    if (platformConnectionDetails) {
-      return withGatewayV2Proxy(
-        async (proxyPort) => {
-          const proxyUrl = constructLdapUrl(protocol, "localhost", proxyPort);
-          const isSSL = protocol === "ldaps";
-
-          const client = ldap.createClient({
-            url: proxyUrl,
-            timeout: LDAP_TIMEOUT,
-            connectTimeout: LDAP_TIMEOUT,
-            tlsOptions: isSSL
-              ? {
-                  rejectUnauthorized: config.credentials.sslRejectUnauthorized,
-                  ca: config.credentials.sslCertificate ? [config.credentials.sslCertificate] : undefined,
-                  servername: host,
-                  // bypass hostname verification for development
-                  ...(appCfg.isDevelopmentMode ? { checkServerIdentity: () => undefined } : {})
-                }
-              : undefined
-          });
-
-          return setupLdapClientHandlers<T>(client, credentials.dn, credentials.password, async (ldapClient) => {
-            try {
-              return await operation(ldapClient);
-            } finally {
-              ldapClient.destroy();
-            }
-          });
-        },
-        {
-          protocol: GatewayProxyProtocol.Tcp,
-          relayHost: platformConnectionDetails.relayHost,
-          gateway: platformConnectionDetails.gateway,
-          relay: platformConnectionDetails.relay
-        }
-      );
+    if (!platformConnectionDetails) {
+      throw new BadRequestError({ message: "Unable to connect to gateway, no platform connection details found" });
     }
+
+    return withGatewayV2Proxy(
+      async (proxyPort) => {
+        const proxyUrl = constructLdapUrl(protocol, "localhost", proxyPort);
+        const isSSL = protocol === "ldaps";
+
+        const client = ldap.createClient({
+          url: proxyUrl,
+          timeout: LDAP_TIMEOUT,
+          connectTimeout: LDAP_TIMEOUT,
+          tlsOptions: isSSL
+            ? {
+                rejectUnauthorized: config.credentials.sslRejectUnauthorized,
+                ca: config.credentials.sslCertificate ? [config.credentials.sslCertificate] : undefined,
+                servername: host,
+                // bypass hostname verification for development
+                ...(appCfg.isDevelopmentMode ? { checkServerIdentity: () => undefined } : {})
+              }
+            : undefined
+        });
+
+        return setupLdapClientHandlers<T>(client, credentials.dn, credentials.password, async (ldapClient) => {
+          try {
+            return await operation(ldapClient);
+          } finally {
+            ldapClient.destroy();
+          }
+        });
+      },
+      {
+        protocol: GatewayProxyProtocol.Tcp,
+        relayHost: platformConnectionDetails.relayHost,
+        gateway: platformConnectionDetails.gateway,
+        relay: platformConnectionDetails.relay
+      }
+    );
   }
 
   // Non-gateway path - calls getLdapConnectionClient which has validation