Merge pull request #2517 from Infisical/revert-2505-revert-2494-daniel/api-errors

feat(api): better errors and documentation

backend/src/services/api-key/api-key-service.ts

@@ -4,7 +4,7 @@ import bcrypt from "bcrypt";
 
 import { TApiKeys } from "@app/db/schemas/api-keys";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+import { NotFoundError, UnauthorizedError } from "@app/lib/errors";
 
 import { TUserDALFactory } from "../user/user-dal";
 import { TApiKeyDALFactory } from "./api-key-dal";
@@ -45,7 +45,7 @@ export const apiKeyServiceFactory = ({ apiKeyDAL, userDAL }: TApiKeyServiceFacto
 
   const deleteApiKey = async (userId: string, apiKeyId: string) => {
     const [apiKeyData] = await apiKeyDAL.delete({ id: apiKeyId, userId });
-    if (!apiKeyData) throw new BadRequestError({ message: "Failed to find api key", name: "delete api key" });
+    if (!apiKeyData) throw new NotFoundError({ message: "API key not found" });
     return formatApiKey(apiKeyData);
   };
 

backend/src/services/auth-token/auth-token-service.ts

@@ -4,7 +4,7 @@ import bcrypt from "bcrypt";
 
 import { TAuthTokens, TAuthTokenSessions } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
-import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 
 import { AuthModeJwtTokenPayload } from "../auth/auth-type";
@@ -150,11 +150,13 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, orgMembershipDAL }: TAu
       id: token.tokenVersionId,
       userId: token.userId
     });
-    if (!session) throw new UnauthorizedError({ name: "Session not found" });
-    if (token.accessVersion !== session.accessVersion) throw new UnauthorizedError({ name: "Stale session" });
+    if (!session) throw new NotFoundError({ name: "Session not found" });
+    if (token.accessVersion !== session.accessVersion) {
+      throw new UnauthorizedError({ name: "StaleSession", message: "User session is stale, please re-authenticate" });
+    }
 
     const user = await userDAL.findById(session.userId);
-    if (!user || !user.isAccepted) throw new UnauthorizedError({ name: "Token user not found" });
+    if (!user || !user.isAccepted) throw new NotFoundError({ message: "User not found" });
 
     if (token.organizationId) {
       const orgMembership = await orgMembershipDAL.findOne({
@@ -162,8 +164,12 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, orgMembershipDAL }: TAu
         orgId: token.organizationId
       });
 
-      if (!orgMembership) throw new ForbiddenRequestError({ message: "User not member of organization" });
-      if (!orgMembership.isActive) throw new ForbiddenRequestError({ message: "User not active in organization" });
+      if (!orgMembership) {
+        throw new ForbiddenRequestError({ message: "User not member of organization" });
+      }
+      if (!orgMembership.isActive) {
+        throw new ForbiddenRequestError({ message: "User organization membership is inactive" });
+      }
     }
 
     return { user, tokenVersionId: token.tokenVersionId, orgId: token.organizationId };

backend/src/services/auth/auth-fns.ts

@@ -1,7 +1,7 @@
 import jwt from "jsonwebtoken";
 
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 
 import { AuthModeProviderJwtTokenPayload, AuthModeProviderSignUpTokenPayload, AuthTokenType } from "./auth-type";
 
@@ -25,15 +25,15 @@ export const validateSignUpAuthorization = (token: string, userId: string, valid
   const appCfg = getConfig();
   const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>token?.split(" ", 2) ?? [null, null];
   if (AUTH_TOKEN_TYPE === null) {
-    throw new BadRequestError({ message: "Missing Authorization Header in the request header." });
+    throw new UnauthorizedError({ message: "Missing Authorization Header in the request header." });
   }
   if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") {
-    throw new BadRequestError({
+    throw new UnauthorizedError({
       message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`
     });
   }
   if (AUTH_TOKEN_VALUE === null) {
-    throw new BadRequestError({
+    throw new UnauthorizedError({
       message: "Missing Authorization Body in the request header"
     });
   }
@@ -47,8 +47,8 @@ export const validateSignUpAuthorization = (token: string, userId: string, valid
 
 export const enforceUserLockStatus = (isLocked: boolean, temporaryLockDateEnd?: Date | null) => {
   if (isLocked) {
-    throw new UnauthorizedError({
-      name: "User Locked",
+    throw new ForbiddenRequestError({
+      name: "UserLocked",
       message:
         "User is locked due to multiple failed login attempts. An email has been sent to you in order to unlock your account. You can also reset your password to unlock your account."
     });
@@ -61,8 +61,8 @@ export const enforceUserLockStatus = (isLocked: boolean, temporaryLockDateEnd?:
       const timeDisplay =
         secondsDiff > 60 ? `${Math.ceil(secondsDiff / 60)} minutes` : `${Math.ceil(secondsDiff)} seconds`;
 
-      throw new UnauthorizedError({
-        name: "User Locked",
+      throw new ForbiddenRequestError({
+        name: "UserLocked",
         message: `User is temporary locked due to multiple failed login attempts. Try again after ${timeDisplay}. You can also reset your password now to proceed.`
       });
     }

backend/src/services/auth/auth-login-service.ts

@@ -8,7 +8,7 @@ import { request } from "@app/lib/config/request";
 import { generateSrpServerKey, srpCheckClientProof } from "@app/lib/crypto";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { getUserPrivateKey } from "@app/lib/crypto/srp";
-import { BadRequestError, DatabaseError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, DatabaseError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
 
@@ -350,7 +350,7 @@ export const authLoginServiceFactory = ({
     const cfg = getConfig();
 
     if (!authJwtToken) throw new UnauthorizedError({ name: "Authorization header is required" });
-    if (!userAgent) throw new UnauthorizedError({ name: "user agent header is required" });
+    if (!userAgent) throw new UnauthorizedError({ name: "User-Agent header is required" });
 
     // eslint-disable-next-line no-param-reassign
     authJwtToken = authJwtToken.replace("Bearer ", ""); // remove bearer from token
@@ -368,7 +368,7 @@ export const authLoginServiceFactory = ({
     const selectedOrg = await orgDAL.findById(organizationId);
 
     if (!hasOrganizationMembership) {
-      throw new UnauthorizedError({
+      throw new ForbiddenRequestError({
         message: `User does not have access to the organization named ${selectedOrg?.name}`
       });
     }

backend/src/services/auth/auth-signup-service.ts

@@ -9,7 +9,7 @@ import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
 import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { generateUserSrpKeys, getUserPrivateKey } from "@app/lib/crypto/srp";
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { isDisposableEmail } from "@app/lib/validator";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
@@ -380,7 +380,7 @@ export const authSignupServiceFactory = ({
       status: OrgMembershipStatus.Invited
     });
     if (!orgMembership)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Failed to find invitation for email",
         name: "complete account invite"
       });

backend/src/services/certificate-authority/certificate-authority-queue.ts

@@ -3,7 +3,7 @@ import crypto from "crypto";
 
 import { getConfig } from "@app/lib/config/env";
 import { daysToMillisecond, secondsToMillis } from "@app/lib/dates";
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -76,7 +76,7 @@ export const certificateAuthorityQueueFactory = ({
     logger.info(`secretReminderQueue.process: [secretDocument=${caId}]`);
 
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id });
 

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -122,7 +122,7 @@ export const certificateAuthorityServiceFactory = ({
     actorOrgId
   }: TCreateCaDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -290,7 +290,7 @@ export const certificateAuthorityServiceFactory = ({
    */
   const getCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -321,7 +321,7 @@ export const certificateAuthorityServiceFactory = ({
     actorOrgId
   }: TUpdateCaDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -346,7 +346,7 @@ export const certificateAuthorityServiceFactory = ({
    */
   const deleteCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCaDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -371,7 +371,7 @@ export const certificateAuthorityServiceFactory = ({
    */
   const getCaCsr = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCsrDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -430,7 +430,7 @@ export const certificateAuthorityServiceFactory = ({
    */
   const renewCaCert = async ({ caId, notAfter, actorId, actorAuthMethod, actor, actorOrgId }: TRenewCaCertDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" });
 
@@ -702,7 +702,7 @@ export const certificateAuthorityServiceFactory = ({
 
   const getCaCerts = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCertsDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -736,7 +736,7 @@ export const certificateAuthorityServiceFactory = ({
    */
   const getCaCert = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCertDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
     if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -817,7 +817,7 @@ export const certificateAuthorityServiceFactory = ({
   }: TSignIntermediateDTO) => {
     const appCfg = getConfig();
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -963,7 +963,7 @@ export const certificateAuthorityServiceFactory = ({
     certificateChain
   }: TImportCertToCaDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1124,7 +1124,7 @@ export const certificateAuthorityServiceFactory = ({
     }
 
     if (!ca) {
-      throw new BadRequestError({ message: "CA not found" });
+      throw new NotFoundError({ message: "CA not found" });
     }
 
     const { permission } = await permissionService.getProjectPermission(
@@ -1451,7 +1451,7 @@ export const certificateAuthorityServiceFactory = ({
     }
 
     if (!ca) {
-      throw new BadRequestError({ message: "CA not found" });
+      throw new NotFoundError({ message: "CA not found" });
     }
 
     if (!dto.isInternal) {
@@ -1810,7 +1810,7 @@ export const certificateAuthorityServiceFactory = ({
     actorOrgId
   }: TGetCaCertificateTemplatesDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
-    if (!ca) throw new BadRequestError({ message: "CA not found" });
+    if (!ca) throw new NotFoundError({ message: "CA not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,

backend/src/services/group-project/group-project-service.ts

@@ -66,7 +66,7 @@ export const groupProjectServiceFactory = ({
   }: TCreateProjectGroupDTO) => {
     const project = await projectDAL.findById(projectId);
 
-    if (!project) throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` });
+    if (!project) throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` });
     if (project.version < 2) throw new BadRequestError({ message: `Failed to add group to E2EE project` });
 
     const { permission } = await permissionService.getProjectPermission(
@@ -79,7 +79,7 @@ export const groupProjectServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Groups);
 
     const group = await groupDAL.findOne({ orgId: actorOrgId, id: groupId });
-    if (!group) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` });
+    if (!group) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` });
 
     const existingGroup = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id });
     if (existingGroup)
@@ -168,24 +168,24 @@ export const groupProjectServiceFactory = ({
         const ghostUser = await projectDAL.findProjectGhostUser(project.id, tx);
 
         if (!ghostUser) {
-          throw new BadRequestError({
-            message: "Failed to find sudo user"
+          throw new NotFoundError({
+            message: "Failed to find project owner"
           });
         }
 
         const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, project.id, tx);
 
         if (!ghostUserLatestKey) {
-          throw new BadRequestError({
-            message: "Failed to find sudo user latest key"
+          throw new NotFoundError({
+            message: "Failed to find project owner's latest key"
           });
         }
 
         const bot = await projectBotDAL.findOne({ projectId: project.id }, tx);
 
         if (!bot) {
-          throw new BadRequestError({
-            message: "Failed to find bot"
+          throw new NotFoundError({
+            message: "Failed to find project bot"
           });
         }
 
@@ -235,7 +235,7 @@ export const groupProjectServiceFactory = ({
   }: TUpdateProjectGroupDTO) => {
     const project = await projectDAL.findById(projectId);
 
-    if (!project) throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` });
+    if (!project) throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -247,10 +247,10 @@ export const groupProjectServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Groups);
 
     const group = await groupDAL.findOne({ orgId: actorOrgId, id: groupId });
-    if (!group) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` });
+    if (!group) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` });
 
     const projectGroup = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id });
-    if (!projectGroup) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` });
+    if (!projectGroup) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` });
 
     for await (const { role: requestedRoleChange } of roles) {
       const { permission: rolePermission } = await permissionService.getProjectPermissionByRole(
@@ -331,13 +331,13 @@ export const groupProjectServiceFactory = ({
   }: TDeleteProjectGroupDTO) => {
     const project = await projectDAL.findById(projectId);
 
-    if (!project) throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` });
+    if (!project) throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` });
 
     const group = await groupDAL.findOne({ orgId: actorOrgId, id: groupId });
-    if (!group) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` });
+    if (!group) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` });
 
     const groupProjectMembership = await groupProjectDAL.findOne({ groupId: group.id, projectId: project.id });
-    if (!groupProjectMembership) throw new BadRequestError({ message: `Failed to find group with ID ${groupId}` });
+    if (!groupProjectMembership) throw new NotFoundError({ message: `Failed to find group with ID ${groupId}` });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -380,7 +380,7 @@ export const groupProjectServiceFactory = ({
     const project = await projectDAL.findById(projectId);
 
     if (!project) {
-      throw new BadRequestError({ message: `Failed to find project with ID ${projectId}` });
+      throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` });
     }
 
     const { permission } = await permissionService.getProjectPermission(

backend/src/services/identity-access-token/identity-access-token-service.ts

@@ -39,7 +39,7 @@ export const identityAccessTokenServiceFactory = ({
 
     if (accessTokenNumUsesLimit > 0 && accessTokenNumUses > 0 && accessTokenNumUses >= accessTokenNumUsesLimit) {
       await identityAccessTokenDAL.deleteById(tokenId);
-      throw new BadRequestError({
+      throw new UnauthorizedError({
         message: "Unable to renew because access token number of uses limit reached"
       });
     }
@@ -81,13 +81,15 @@ export const identityAccessTokenServiceFactory = ({
     const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload & {
       identityAccessTokenId: string;
     };
-    if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) throw new UnauthorizedError();
+    if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) {
+      throw new BadRequestError({ message: "Only identity access tokens can be renewed" });
+    }
 
     const identityAccessToken = await identityAccessTokenDAL.findOne({
       [`${TableName.IdentityAccessToken}.id` as "id"]: decodedToken.identityAccessTokenId,
       isAccessTokenRevoked: false
     });
-    if (!identityAccessToken) throw new UnauthorizedError();
+    if (!identityAccessToken) throw new UnauthorizedError({ message: "No identity access token found" });
 
     let { accessTokenNumUses } = identityAccessToken;
     const tokenStatusInCache = await accessTokenQueue.getIdentityTokenDetailsInCache(identityAccessToken.id);
@@ -134,13 +136,15 @@ export const identityAccessTokenServiceFactory = ({
     const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload & {
       identityAccessTokenId: string;
     };
-    if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) throw new UnauthorizedError();
+    if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) {
+      throw new UnauthorizedError({ message: "Only identity access tokens can be revoked" });
+    }
 
     const identityAccessToken = await identityAccessTokenDAL.findOne({
       [`${TableName.IdentityAccessToken}.id` as "id"]: decodedToken.identityAccessTokenId,
       isAccessTokenRevoked: false
     });
-    if (!identityAccessToken) throw new UnauthorizedError();
+    if (!identityAccessToken) throw new UnauthorizedError({ message: "No identity access token found" });
 
     const revokedToken = await identityAccessTokenDAL.updateById(identityAccessToken.id, {
       isAccessTokenRevoked: true
@@ -154,10 +158,10 @@ export const identityAccessTokenServiceFactory = ({
       [`${TableName.IdentityAccessToken}.id` as "id"]: token.identityAccessTokenId,
       isAccessTokenRevoked: false
     });
-    if (!identityAccessToken) throw new UnauthorizedError();
+    if (!identityAccessToken) throw new UnauthorizedError({ message: "No identity access token found" });
     if (identityAccessToken.isAccessTokenRevoked)
       throw new UnauthorizedError({
-        message: "Failed to authorize revoked access token"
+        message: "Failed to authorize revoked access token, access token is revoked"
       });
 
     if (ipAddress && identityAccessToken) {
@@ -172,7 +176,7 @@ export const identityAccessTokenServiceFactory = ({
     });
 
     if (!identityOrgMembership) {
-      throw new UnauthorizedError({ message: "Identity does not belong to any organization" });
+      throw new BadRequestError({ message: "Identity does not belong to any organization" });
     }
 
     let { accessTokenNumUses } = identityAccessToken;

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -9,7 +9,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -50,7 +50,9 @@ export const identityAwsAuthServiceFactory = ({
 }: TIdentityAwsAuthServiceFactoryDep) => {
   const login = async ({ identityId, iamHttpRequestMethod, iamRequestBody, iamRequestHeaders }: TLoginAwsAuthDTO) => {
     const identityAwsAuth = await identityAwsAuthDAL.findOne({ identityId });
-    if (!identityAwsAuth) throw new UnauthorizedError();
+    if (!identityAwsAuth) {
+      throw new NotFoundError({ message: "AWS auth method not found for identity, did you configure AWS auth?" });
+    }
 
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityAwsAuth.identityId });
 
@@ -79,7 +81,7 @@ export const identityAwsAuthServiceFactory = ({
         .some((accountId) => accountId === Account);
 
       if (!isAccountAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: AWS account ID not allowed."
         });
     }
@@ -98,7 +100,7 @@ export const identityAwsAuthServiceFactory = ({
         });
 
       if (!isArnAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: AWS principal ARN not allowed."
         });
     }
@@ -152,7 +154,7 @@ export const identityAwsAuthServiceFactory = ({
     actorOrgId
   }: TAttachAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity.authMethod)
       throw new BadRequestError({
         message: "Failed to add AWS Auth to already configured identity"
@@ -231,7 +233,7 @@ export const identityAwsAuthServiceFactory = ({
     actorOrgId
   }: TUpdateAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH)
       throw new BadRequestError({
         message: "Failed to update AWS Auth"
@@ -290,7 +292,7 @@ export const identityAwsAuthServiceFactory = ({
 
   const getAwsAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH)
       throw new BadRequestError({
         message: "The identity does not have AWS Auth attached"
@@ -317,7 +319,7 @@ export const identityAwsAuthServiceFactory = ({
     actorOrgId
   }: TRevokeAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH)
       throw new BadRequestError({
         message: "The identity does not have aws auth"
@@ -338,8 +340,8 @@ export const identityAwsAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to revoke aws auth of identity with more privileged role"
       });

backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts

@@ -24,7 +24,7 @@ export const validateAzureIdentity = async ({
   const signingKeys = data.keys;
 
   const signingKey = signingKeys.find((key) => key.kid === kid);
-  if (!signingKey) throw new UnauthorizedError();
+  if (!signingKey) throw new UnauthorizedError({ message: "Invalid signing key" });
 
   const publicKey = `-----BEGIN CERTIFICATE-----\n${signingKey.x5c[0]}\n-----END CERTIFICATE-----`;
 

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -7,7 +7,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -49,10 +49,12 @@ export const identityAzureAuthServiceFactory = ({
 }: TIdentityAzureAuthServiceFactoryDep) => {
   const login = async ({ identityId, jwt: azureJwt }: TLoginAzureAuthDTO) => {
     const identityAzureAuth = await identityAzureAuthDAL.findOne({ identityId });
-    if (!identityAzureAuth) throw new UnauthorizedError();
+    if (!identityAzureAuth) {
+      throw new NotFoundError({ message: "Azure auth method not found for identity, did you configure Azure Auth?" });
+    }
 
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityAzureAuth.identityId });
-    if (!identityMembershipOrg) throw new UnauthorizedError();
+    if (!identityMembershipOrg) throw new UnauthorizedError({ message: "Identity not attached to a organization" });
 
     const azureIdentity = await validateAzureIdentity({
       tenantId: identityAzureAuth.tenantId,
@@ -60,7 +62,8 @@ export const identityAzureAuthServiceFactory = ({
       jwt: azureJwt
     });
 
-    if (azureIdentity.tid !== identityAzureAuth.tenantId) throw new UnauthorizedError();
+    if (azureIdentity.tid !== identityAzureAuth.tenantId)
+      throw new UnauthorizedError({ message: "Tenant ID mismatch" });
 
     if (identityAzureAuth.allowedServicePrincipalIds) {
       // validate if the service principal id is in the list of allowed service principal ids
@@ -70,7 +73,7 @@ export const identityAzureAuthServiceFactory = ({
         .map((servicePrincipalId) => servicePrincipalId.trim())
         .some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid);
 
-      if (!isServicePrincipalAllowed) throw new UnauthorizedError();
+      if (!isServicePrincipalAllowed) throw new UnauthorizedError({ message: "Service principal not allowed" });
     }
 
     const identityAccessToken = await identityAzureAuthDAL.transaction(async (tx) => {
@@ -122,7 +125,7 @@ export const identityAzureAuthServiceFactory = ({
     actorOrgId
   }: TAttachAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity.authMethod)
       throw new BadRequestError({
         message: "Failed to add Azure Auth to already configured identity"
@@ -200,7 +203,7 @@ export const identityAzureAuthServiceFactory = ({
     actorOrgId
   }: TUpdateAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH)
       throw new BadRequestError({
         message: "Failed to update Azure Auth"
@@ -262,7 +265,7 @@ export const identityAzureAuthServiceFactory = ({
 
   const getAzureAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH)
       throw new BadRequestError({
         message: "The identity does not have Azure Auth attached"
@@ -290,7 +293,7 @@ export const identityAzureAuthServiceFactory = ({
     actorOrgId
   }: TRevokeAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH)
       throw new BadRequestError({
         message: "The identity does not have azure auth"
@@ -311,8 +314,7 @@ export const identityAzureAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to revoke azure auth of identity with more privileged role"
       });

backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts

@@ -65,6 +65,6 @@ export const validateIamIdentity = async ({
     algorithms: ["RS256"]
   });
 
-  if (aud !== identityId) throw new UnauthorizedError();
+  if (aud !== identityId) throw new UnauthorizedError({ message: "Invalid audience in GCP IAM Token" });
   return { email: sub };
 };

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -7,7 +7,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -47,10 +47,14 @@ export const identityGcpAuthServiceFactory = ({
 }: TIdentityGcpAuthServiceFactoryDep) => {
   const login = async ({ identityId, jwt: gcpJwt }: TLoginGcpAuthDTO) => {
     const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId });
-    if (!identityGcpAuth) throw new UnauthorizedError();
+    if (!identityGcpAuth) {
+      throw new NotFoundError({ message: "GCP auth method not found for identity, did you configure GCP auth?" });
+    }
 
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityGcpAuth.identityId });
-    if (!identityMembershipOrg) throw new UnauthorizedError();
+    if (!identityMembershipOrg) {
+      throw new UnauthorizedError({ message: "Identity does not belong to any organization" });
+    }
 
     let gcpIdentityDetails: TGcpIdentityDetails;
     switch (identityGcpAuth.type) {
@@ -82,7 +86,7 @@ export const identityGcpAuthServiceFactory = ({
         .some((serviceAccount) => serviceAccount === gcpIdentityDetails.email);
 
       if (!isServiceAccountAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: GCP service account not allowed."
         });
     }
@@ -96,7 +100,7 @@ export const identityGcpAuthServiceFactory = ({
         .some((project) => project === gcpIdentityDetails.computeEngineDetails?.project_id);
 
       if (!isProjectAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: GCP project not allowed."
         });
     }
@@ -108,7 +112,7 @@ export const identityGcpAuthServiceFactory = ({
         .some((zone) => zone === gcpIdentityDetails.computeEngineDetails?.zone);
 
       if (!isZoneAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: GCP zone not allowed."
         });
     }
@@ -163,7 +167,7 @@ export const identityGcpAuthServiceFactory = ({
     actorOrgId
   }: TAttachGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity.authMethod)
       throw new BadRequestError({
         message: "Failed to add GCP Auth to already configured identity"
@@ -243,7 +247,7 @@ export const identityGcpAuthServiceFactory = ({
     actorOrgId
   }: TUpdateGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH)
       throw new BadRequestError({
         message: "Failed to update GCP Auth"
@@ -306,7 +310,7 @@ export const identityGcpAuthServiceFactory = ({
 
   const getGcpAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH)
       throw new BadRequestError({
         message: "The identity does not have GCP Auth attached"
@@ -334,7 +338,7 @@ export const identityGcpAuthServiceFactory = ({
     actorOrgId
   }: TRevokeGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH)
       throw new BadRequestError({
         message: "The identity does not have gcp auth"
@@ -355,8 +359,7 @@ export const identityGcpAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to revoke gcp auth of identity with more privileged role"
       });

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -17,7 +17,7 @@ import {
   infisicalSymmetricDecrypt,
   infisicalSymmetricEncypt
 } from "@app/lib/crypto/encryption";
-import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
 
@@ -63,15 +63,19 @@ export const identityKubernetesAuthServiceFactory = ({
 }: TIdentityKubernetesAuthServiceFactoryDep) => {
   const login = async ({ identityId, jwt: serviceAccountJwt }: TLoginKubernetesAuthDTO) => {
     const identityKubernetesAuth = await identityKubernetesAuthDAL.findOne({ identityId });
-    if (!identityKubernetesAuth) throw new UnauthorizedError();
+    if (!identityKubernetesAuth) {
+      throw new NotFoundError({
+        message: "Kubernetes auth method not found for identity, did you configure Kubernetes auth?"
+      });
+    }
 
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({
       identityId: identityKubernetesAuth.identityId
     });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Identity organization membership not found" });
 
     const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId });
-    if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+    if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" });
 
     const key = infisicalSymmetricDecrypt({
       ciphertext: orgBot.encryptedSymmetricKey,
@@ -127,7 +131,8 @@ export const identityKubernetesAuthServiceFactory = ({
     if ("error" in data.status) throw new UnauthorizedError({ message: data.status.error });
 
     // check the response to determine if the token is valid
-    if (!(data.status && data.status.authenticated)) throw new UnauthorizedError();
+    if (!(data.status && data.status.authenticated))
+      throw new UnauthorizedError({ message: "Kubernetes token not authenticated" });
 
     const { namespace: targetNamespace, name: targetName } = extractK8sUsername(data.status.user.username);
 
@@ -140,7 +145,7 @@ export const identityKubernetesAuthServiceFactory = ({
         .some((namespace) => namespace === targetNamespace);
 
       if (!isNamespaceAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: K8s namespace not allowed."
         });
     }
@@ -154,7 +159,7 @@ export const identityKubernetesAuthServiceFactory = ({
         .some((name) => name === targetName);
 
       if (!isNameAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: K8s name not allowed."
         });
     }
@@ -166,7 +171,7 @@ export const identityKubernetesAuthServiceFactory = ({
       );
 
       if (!isAudienceAllowed)
-        throw new ForbiddenRequestError({
+        throw new UnauthorizedError({
           message: "Access denied: K8s audience not allowed."
         });
     }
@@ -223,7 +228,7 @@ export const identityKubernetesAuthServiceFactory = ({
     actorOrgId
   }: TAttachKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity.authMethod)
       throw new BadRequestError({
         message: "Failed to add Kubernetes Auth to already configured identity"
@@ -367,7 +372,7 @@ export const identityKubernetesAuthServiceFactory = ({
     actorOrgId
   }: TUpdateKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH)
       throw new BadRequestError({
         message: "Failed to update Kubernetes Auth"
@@ -424,7 +429,7 @@ export const identityKubernetesAuthServiceFactory = ({
     };
 
     const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId });
-    if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+    if (!orgBot) throw new NotFoundError({ message: "Org bot not found", name: "OrgBotNotFound" });
 
     const key = infisicalSymmetricDecrypt({
       ciphertext: orgBot.encryptedSymmetricKey,
@@ -491,7 +496,7 @@ export const identityKubernetesAuthServiceFactory = ({
     actorOrgId
   }: TGetKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH)
       throw new BadRequestError({
         message: "The identity does not have Kubernetes Auth attached"
@@ -509,7 +514,7 @@ export const identityKubernetesAuthServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Identity);
 
     const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId });
-    if (!orgBot) throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+    if (!orgBot) throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" });
 
     const key = infisicalSymmetricDecrypt({
       ciphertext: orgBot.encryptedSymmetricKey,
@@ -552,10 +557,10 @@ export const identityKubernetesAuthServiceFactory = ({
     actorOrgId
   }: TRevokeKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH)
       throw new BadRequestError({
-        message: "The identity does not have kubenetes auth"
+        message: "The identity does not have kubernetes auth"
       });
     const { permission } = await permissionService.getOrgPermission(
       actor,
@@ -573,10 +578,9 @@ export const identityKubernetesAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        message: "Failed to revoke kubenetes auth of identity with more privileged role"
+        message: "Failed to revoke kubernetes auth of identity with more privileged role"
       });
 
     const revokedIdentityKubernetesAuth = await identityKubernetesAuthDAL.transaction(async (tx) => {

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -61,19 +61,19 @@ export const identityOidcAuthServiceFactory = ({
   const login = async ({ identityId, jwt: oidcJwt }: TLoginOidcAuthDTO) => {
     const identityOidcAuth = await identityOidcAuthDAL.findOne({ identityId });
     if (!identityOidcAuth) {
-      throw new UnauthorizedError();
+      throw new NotFoundError({ message: "GCP auth method not found for identity, did you configure GCP auth?" });
     }
 
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({
       identityId: identityOidcAuth.identityId
     });
     if (!identityMembershipOrg) {
-      throw new NotFoundError({ message: "Failed to find identity in organization" });
+      throw new NotFoundError({ message: "Identity organization membership not found" });
     }
 
     const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId });
     if (!orgBot) {
-      throw new NotFoundError({ message: "Org bot not found", name: "OrgBotNotFound" });
+      throw new NotFoundError({ message: "Organization bot was not found", name: "OrgBotNotFound" });
     }
 
     const key = infisicalSymmetricDecrypt({
@@ -136,7 +136,7 @@ export const identityOidcAuthServiceFactory = ({
 
     if (identityOidcAuth.boundSubject) {
       if (!doesFieldValueMatchOidcPolicy(tokenData.sub, identityOidcAuth.boundSubject)) {
-        throw new UnauthorizedError({
+        throw new ForbiddenRequestError({
           message: "Access denied: OIDC subject not allowed."
         });
       }
@@ -221,7 +221,7 @@ export const identityOidcAuthServiceFactory = ({
   }: TAttachOidcAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) {
-      throw new BadRequestError({ message: "Failed to find identity" });
+      throw new NotFoundError({ message: "Failed to find identity" });
     }
     if (identityMembershipOrg.identity.authMethod)
       throw new BadRequestError({
@@ -360,7 +360,7 @@ export const identityOidcAuthServiceFactory = ({
   }: TUpdateOidcAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) {
-      throw new BadRequestError({ message: "Failed to find identity" });
+      throw new NotFoundError({ message: "Failed to find identity" });
     }
 
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) {
@@ -422,7 +422,7 @@ export const identityOidcAuthServiceFactory = ({
 
     const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId });
     if (!orgBot) {
-      throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+      throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" });
     }
 
     const key = infisicalSymmetricDecrypt({
@@ -460,7 +460,7 @@ export const identityOidcAuthServiceFactory = ({
   const getOidcAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetOidcAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) {
-      throw new BadRequestError({ message: "Failed to find identity" });
+      throw new NotFoundError({ message: "Failed to find identity" });
     }
 
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) {
@@ -482,7 +482,7 @@ export const identityOidcAuthServiceFactory = ({
 
     const orgBot = await orgBotDAL.findOne({ orgId: identityMembershipOrg.orgId });
     if (!orgBot) {
-      throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+      throw new NotFoundError({ message: "Organization bot not found", name: "OrgBotNotFound" });
     }
 
     const key = infisicalSymmetricDecrypt({
@@ -505,7 +505,7 @@ export const identityOidcAuthServiceFactory = ({
   const revokeOidcAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TRevokeOidcAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) {
-      throw new BadRequestError({ message: "Failed to find identity" });
+      throw new NotFoundError({ message: "Failed to find identity" });
     }
 
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) {
@@ -532,8 +532,7 @@ export const identityOidcAuthServiceFactory = ({
       actorOrgId
     );
 
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge) {
+    if (!isAtLeastAsPrivileged(permission, rolePermission)) {
       throw new ForbiddenRequestError({
         message: "Failed to revoke OIDC auth of identity with more privileged role"
       });

backend/src/services/identity-project/identity-project-service.ts

@@ -5,7 +5,7 @@ import { ProjectMembershipRole } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
-import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 
 import { ActorType } from "../auth/auth-type";
@@ -75,7 +75,7 @@ export const identityProjectServiceFactory = ({
       orgId: project.orgId
     });
     if (!identityOrgMembership)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: `Failed to find identity with id ${identityId}`
       });
 
@@ -103,7 +103,8 @@ export const identityProjectServiceFactory = ({
           $in: { slug: customInputRoles.map(({ role }) => role) }
         })
       : [];
-    if (customRoles.length !== customInputRoles.length) throw new BadRequestError({ message: "Custom role not found" });
+    if (customRoles.length !== customInputRoles.length)
+      throw new NotFoundError({ message: "Custom project roles not found" });
 
     const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug);
     const projectIdentity = await identityProjectDAL.transaction(async (tx) => {
@@ -164,7 +165,7 @@ export const identityProjectServiceFactory = ({
 
     const projectIdentity = await identityProjectDAL.findOne({ identityId, projectId });
     if (!projectIdentity)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: `Identity with id ${identityId} doesn't exists in project with id ${projectId}`
       });
 
@@ -174,9 +175,7 @@ export const identityProjectServiceFactory = ({
         projectId
       );
 
-      const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission);
-
-      if (!hasRequiredPriviledges) {
+      if (!isAtLeastAsPrivileged(permission, rolePermission)) {
         throw new ForbiddenRequestError({ message: "Failed to change to a more privileged role" });
       }
     }
@@ -192,7 +191,8 @@ export const identityProjectServiceFactory = ({
           $in: { slug: customInputRoles.map(({ role }) => role) }
         })
       : [];
-    if (customRoles.length !== customInputRoles.length) throw new BadRequestError({ message: "Custom role not found" });
+    if (customRoles.length !== customInputRoles.length)
+      throw new NotFoundError({ message: "Custom project roles not found" });
 
     const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug);
 
@@ -238,7 +238,7 @@ export const identityProjectServiceFactory = ({
   }: TDeleteProjectIdentityDTO) => {
     const identityProjectMembership = await identityProjectDAL.findOne({ identityId, projectId });
     if (!identityProjectMembership)
-      throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` });
+      throw new NotFoundError({ message: `Failed to find identity with id ${identityId}` });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -255,8 +255,7 @@ export const identityProjectServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
-    if (!hasRequiredPriviledges)
+    if (!isAtLeastAsPrivileged(permission, identityRolePermission))
       throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" });
 
     const [deletedIdentity] = await identityProjectDAL.delete({ identityId, projectId });
@@ -315,7 +314,7 @@ export const identityProjectServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Identity);
 
     const [identityMembership] = await identityProjectDAL.findByProjectId(projectId, { identityId });
-    if (!identityMembership) throw new BadRequestError({ message: `Membership not found for identity ${identityId}` });
+    if (!identityMembership) throw new NotFoundError({ message: `Membership not found for identity ${identityId}` });
     return identityMembership;
   };
 

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -7,7 +7,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -64,7 +64,7 @@ export const identityTokenAuthServiceFactory = ({
     actorOrgId
   }: TAttachTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity.authMethod)
       throw new BadRequestError({
         message: "Failed to add Token Auth to already configured identity"
@@ -136,7 +136,7 @@ export const identityTokenAuthServiceFactory = ({
     actorOrgId
   }: TUpdateTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
       throw new BadRequestError({
         message: "Failed to update Token Auth"
@@ -196,7 +196,7 @@ export const identityTokenAuthServiceFactory = ({
 
   const getTokenAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
       throw new BadRequestError({
         message: "The identity does not have Token Auth attached"
@@ -224,7 +224,7 @@ export const identityTokenAuthServiceFactory = ({
     actorOrgId
   }: TRevokeTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
@@ -245,11 +245,12 @@ export const identityTokenAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
-      throw new UnauthorizedError({
+
+    if (!isAtLeastAsPrivileged(permission, rolePermission)) {
+      throw new ForbiddenRequestError({
         message: "Failed to revoke Token Auth of identity with more privileged role"
       });
+    }
 
     const revokedIdentityTokenAuth = await identityTokenAuthDAL.transaction(async (tx) => {
       const deletedTokenAuth = await identityTokenAuthDAL.delete({ identityId }, tx);
@@ -268,7 +269,7 @@ export const identityTokenAuthServiceFactory = ({
     name
   }: TCreateTokenAuthTokenDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
@@ -342,7 +343,7 @@ export const identityTokenAuthServiceFactory = ({
     actorOrgId
   }: TGetTokenAuthTokensDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
@@ -377,7 +378,7 @@ export const identityTokenAuthServiceFactory = ({
     const foundToken = await identityAccessTokenDAL.findById(tokenId);
     if (!foundToken) throw new NotFoundError({ message: "Failed to find token" });
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: foundToken.identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
@@ -438,7 +439,7 @@ export const identityTokenAuthServiceFactory = ({
     });
 
     if (!identityOrgMembership) {
-      throw new UnauthorizedError({ message: "Identity does not belong to any organization" });
+      throw new NotFoundError({ message: "No identity organization membership found" });
     }
 
     const { permission } = await permissionService.getOrgPermission(

backend/src/services/identity-ua/identity-ua-service.ts

@@ -10,7 +10,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -54,7 +54,11 @@ export const identityUaServiceFactory = ({
 }: TIdentityUaServiceFactoryDep) => {
   const login = async (clientId: string, clientSecret: string, ip: string) => {
     const identityUa = await identityUaDAL.findOne({ clientId });
-    if (!identityUa) throw new UnauthorizedError({ message: "Invalid credentials" });
+    if (!identityUa) {
+      throw new NotFoundError({
+        message: "No identity with specified client ID was found"
+      });
+    }
 
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId: identityUa.identityId });
 
@@ -85,7 +89,7 @@ export const identityUaServiceFactory = ({
         });
 
         throw new UnauthorizedError({
-          message: "Failed to authenticate identity credentials due to expired client secret"
+          message: "Access denied due to expired client secret"
         });
       }
     }
@@ -97,7 +101,7 @@ export const identityUaServiceFactory = ({
         isClientSecretRevoked: true
       });
       throw new UnauthorizedError({
-        message: "Failed to authenticate identity credentials due to client secret number of uses limit reached"
+        message: "Access denied due to client secret usage limit reached"
       });
     }
 
@@ -151,7 +155,7 @@ export const identityUaServiceFactory = ({
     actorOrgId
   }: TAttachUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity.authMethod)
       throw new BadRequestError({
         message: "Failed to add universal auth to already configured identity"
@@ -242,7 +246,7 @@ export const identityUaServiceFactory = ({
     actorOrgId
   }: TUpdateUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
       throw new BadRequestError({
         message: "Failed to updated universal auth"
@@ -316,7 +320,7 @@ export const identityUaServiceFactory = ({
 
   const getIdentityUniversalAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
       throw new BadRequestError({
         message: "The identity does not have universal auth"
@@ -343,7 +347,7 @@ export const identityUaServiceFactory = ({
     actorOrgId
   }: TRevokeUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
       throw new BadRequestError({
         message: "The identity does not have universal auth"
@@ -364,8 +368,7 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to revoke universal auth of identity with more privileged role"
       });
@@ -389,7 +392,7 @@ export const identityUaServiceFactory = ({
     numUsesLimit
   }: TCreateUaClientSecretDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
       throw new BadRequestError({
         message: "The identity does not have universal auth"
@@ -449,7 +452,7 @@ export const identityUaServiceFactory = ({
     identityId
   }: TGetUaClientSecretsDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
       throw new BadRequestError({
         message: "The identity does not have universal auth"
@@ -470,8 +473,8 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to add identity to project with more privileged role"
       });
@@ -496,7 +499,7 @@ export const identityUaServiceFactory = ({
     clientSecretId
   }: TGetUniversalAuthClientSecretByIdDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
       throw new BadRequestError({
         message: "The identity does not have universal auth"
@@ -517,8 +520,7 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to read identity client secret of project with more privileged role"
       });
@@ -536,7 +538,7 @@ export const identityUaServiceFactory = ({
     clientSecretId
   }: TRevokeUaClientSecretDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: "Failed to find identity" });
     if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
       throw new BadRequestError({
         message: "The identity does not have universal auth"
@@ -557,8 +559,8 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
+
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
         message: "Failed to revoke identity client secret with more privileged role"
       });

backend/src/services/identity/identity-service.ts

@@ -55,7 +55,8 @@ export const identityServiceFactory = ({
     );
     const isCustomRole = Boolean(customRole);
     const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasRequiredPriviledges) throw new BadRequestError({ message: "Failed to create a more privileged identity" });
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to create a more privileged identity" });
 
     const plan = await licenseService.getPlan(orgId);
 
@@ -94,7 +95,7 @@ export const identityServiceFactory = ({
     actorOrgId
   }: TUpdateIdentityDTO) => {
     const identityOrgMembership = await identityOrgMembershipDAL.findOne({ identityId: id });
-    if (!identityOrgMembership) throw new BadRequestError({ message: `Failed to find identity with id ${id}` });
+    if (!identityOrgMembership) throw new NotFoundError({ message: `Failed to find identity with id ${id}` });
 
     const { permission } = await permissionService.getOrgPermission(
       actor,
@@ -126,7 +127,7 @@ export const identityServiceFactory = ({
       const isCustomRole = Boolean(customOrgRole);
       const hasRequiredNewRolePermission = isAtLeastAsPrivileged(permission, rolePermission);
       if (!hasRequiredNewRolePermission)
-        throw new BadRequestError({ message: "Failed to create a more privileged identity" });
+        throw new ForbiddenRequestError({ message: "Failed to create a more privileged identity" });
       if (isCustomRole) customRole = customOrgRole;
     }
 
@@ -153,7 +154,7 @@ export const identityServiceFactory = ({
       [`${TableName.IdentityOrgMembership}.identityId` as "identityId"]: id
     });
     const identity = doc[0];
-    if (!identity) throw new BadRequestError({ message: `Failed to find identity with id ${id}` });
+    if (!identity) throw new NotFoundError({ message: `Failed to find identity with id ${id}` });
 
     const { permission } = await permissionService.getOrgPermission(
       actor,
@@ -168,7 +169,7 @@ export const identityServiceFactory = ({
 
   const deleteIdentity = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TDeleteIdentityDTO) => {
     const identityOrgMembership = await identityOrgMembershipDAL.findOne({ identityId: id });
-    if (!identityOrgMembership) throw new BadRequestError({ message: `Failed to find identity with id ${id}` });
+    if (!identityOrgMembership) throw new NotFoundError({ message: `Failed to find identity with id ${id}` });
 
     const { permission } = await permissionService.getOrgPermission(
       actor,

backend/src/services/integration-auth/integration-app-list.ts

@@ -2,7 +2,7 @@
 import { Octokit } from "@octokit/rest";
 
 import { request } from "@app/lib/config/request";
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 
 import { Integrations, IntegrationUrls } from "./integration-list";
 
@@ -1192,6 +1192,6 @@ export const getApps = async ({
       });
 
     default:
-      throw new BadRequestError({ message: "integration not found" });
+      throw new NotFoundError({ message: "integration not found" });
   }
 };

backend/src/services/integration-auth/integration-auth-service.ts

@@ -7,7 +7,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { request } from "@app/lib/config/request";
 import { decryptSymmetric128BitHexKeyUTF8, encryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
 
 import { TIntegrationDALFactory } from "../integration/integration-dal";
@@ -88,7 +88,7 @@ export const integrationAuthServiceFactory = ({
 
   const getIntegrationAuth = async ({ actor, id, actorId, actorAuthMethod, actorOrgId }: TGetIntegrationAuthDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -162,7 +162,7 @@ export const integrationAuthServiceFactory = ({
         updateDoc.encryptedAccess = accessToken;
       }
     } else {
-      if (!botKey) throw new BadRequestError({ message: "Bot key not found" });
+      if (!botKey) throw new NotFoundError({ message: "Project bot key not found" });
       if (tokenExchange.refreshToken) {
         const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenExchange.refreshToken, botKey);
         updateDoc.refreshIV = refreshEncToken.iv;
@@ -273,7 +273,7 @@ export const integrationAuthServiceFactory = ({
         }
       }
     } else {
-      if (!botKey) throw new BadRequestError({ message: "Bot key not found" });
+      if (!botKey) throw new NotFoundError({ message: "Project bot key not found" });
       if (refreshToken) {
         const tokenDetails = await exchangeRefresh(
           integration,
@@ -379,7 +379,7 @@ export const integrationAuthServiceFactory = ({
 
       // the old bot key is else
     } else {
-      if (!botKey) throw new BadRequestError({ message: "bot key is missing" });
+      if (!botKey) throw new NotFoundError({ message: "Project bot key not found" });
       if (integrationAuth.accessTag && integrationAuth.accessIV && integrationAuth.accessCiphertext) {
         accessToken = decryptSymmetric128BitHexKeyUTF8({
           ciphertext: integrationAuth.accessCiphertext,
@@ -445,7 +445,7 @@ export const integrationAuthServiceFactory = ({
     workspaceSlug
   }: TIntegrationAuthAppsDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -478,7 +478,7 @@ export const integrationAuthServiceFactory = ({
     id
   }: TIntegrationAuthTeamsDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -508,7 +508,7 @@ export const integrationAuthServiceFactory = ({
     actorOrgId
   }: TIntegrationAuthVercelBranchesDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -549,7 +549,7 @@ export const integrationAuthServiceFactory = ({
     accountId
   }: TIntegrationAuthChecklyGroupsDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -576,7 +576,7 @@ export const integrationAuthServiceFactory = ({
 
   const getGithubOrgs = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TIntegrationAuthGithubOrgsDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -613,7 +613,7 @@ export const integrationAuthServiceFactory = ({
     repoName
   }: TIntegrationAuthGithubEnvsDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -645,7 +645,7 @@ export const integrationAuthServiceFactory = ({
 
   const getQoveryOrgs = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TIntegrationAuthQoveryOrgsDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -679,7 +679,7 @@ export const integrationAuthServiceFactory = ({
     region
   }: TIntegrationAuthAwsKmsKeyDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -737,7 +737,7 @@ export const integrationAuthServiceFactory = ({
     orgId
   }: TIntegrationAuthQoveryProjectDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -773,7 +773,7 @@ export const integrationAuthServiceFactory = ({
     actorOrgId
   }: TIntegrationAuthQoveryEnvironmentsDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -814,7 +814,7 @@ export const integrationAuthServiceFactory = ({
     environmentId
   }: TIntegrationAuthQoveryScopesDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -854,7 +854,7 @@ export const integrationAuthServiceFactory = ({
     environmentId
   }: TIntegrationAuthQoveryScopesDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -894,7 +894,7 @@ export const integrationAuthServiceFactory = ({
     environmentId
   }: TIntegrationAuthQoveryScopesDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -933,7 +933,7 @@ export const integrationAuthServiceFactory = ({
     actorOrgId
   }: TIntegrationAuthHerokuPipelinesDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -973,7 +973,7 @@ export const integrationAuthServiceFactory = ({
     appId
   }: TIntegrationAuthRailwayEnvDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1041,7 +1041,7 @@ export const integrationAuthServiceFactory = ({
     appId
   }: TIntegrationAuthRailwayServicesDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1115,7 +1115,7 @@ export const integrationAuthServiceFactory = ({
     id
   }: TIntegrationAuthBitbucketWorkspaceDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1164,7 +1164,7 @@ export const integrationAuthServiceFactory = ({
     appId
   }: TIntegrationAuthNorthflankSecretGroupDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1232,7 +1232,7 @@ export const integrationAuthServiceFactory = ({
     actor
   }: TGetIntegrationAuthTeamCityBuildConfigDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1294,7 +1294,7 @@ export const integrationAuthServiceFactory = ({
     actorOrgId
   }: TDeleteIntegrationAuthByIdDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(id);
-    if (!integrationAuth) throw new BadRequestError({ message: "Failed to find integration" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1307,7 +1307,7 @@ export const integrationAuthServiceFactory = ({
 
     const delIntegrationAuth = await integrationAuthDAL.transaction(async (tx) => {
       const doc = await integrationAuthDAL.deleteById(integrationAuth.id, tx);
-      if (!doc) throw new BadRequestError({ message: "Faled to find integration" });
+      if (!doc) throw new NotFoundError({ message: "Faled to find integration" });
       await integrationDAL.delete({ integrationAuthId: doc.id }, tx);
       return doc;
     });

backend/src/services/integration-auth/integration-token.ts

@@ -2,7 +2,7 @@ import jwt from "jsonwebtoken";
 
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { Integrations, IntegrationUrls } from "./integration-list";
 
@@ -396,7 +396,7 @@ export const exchangeCode = async ({
         code
       });
     default:
-      throw new BadRequestError({ message: "Unknown integration" });
+      throw new NotFoundError({ message: "Unknown integration" });
   }
 };
 

backend/src/services/integration/integration-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
 
 import { TIntegrationAuthDALFactory } from "../integration-auth/integration-auth-dal";
@@ -76,7 +76,7 @@ export const integrationServiceFactory = ({
     targetEnvironmentId
   }: TCreateIntegrationDTO) => {
     const integrationAuth = await integrationAuthDAL.findById(integrationAuthId);
-    if (!integrationAuth) throw new BadRequestError({ message: "Integration auth not found" });
+    if (!integrationAuth) throw new NotFoundError({ message: "Integration auth not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -93,7 +93,7 @@ export const integrationServiceFactory = ({
     );
 
     const folder = await folderDAL.findBySecretPath(integrationAuth.projectId, sourceEnvironment, secretPath);
-    if (!folder) throw new BadRequestError({ message: "Folder path not found" });
+    if (!folder) throw new NotFoundError({ message: "Folder path not found" });
 
     const integration = await integrationDAL.create({
       envId: folder.envId,
@@ -139,7 +139,7 @@ export const integrationServiceFactory = ({
     metadata
   }: TUpdateIntegrationDTO) => {
     const integration = await integrationDAL.findById(id);
-    if (!integration) throw new BadRequestError({ message: "Integration auth not found" });
+    if (!integration) throw new NotFoundError({ message: "Integration auth not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -156,7 +156,7 @@ export const integrationServiceFactory = ({
     );
 
     const folder = await folderDAL.findBySecretPath(integration.projectId, environment, secretPath);
-    if (!folder) throw new BadRequestError({ message: "Folder path not found" });
+    if (!folder) throw new NotFoundError({ message: "Folder path not found" });
 
     const updatedIntegration = await integrationDAL.updateById(id, {
       envId: folder.envId,
@@ -211,7 +211,7 @@ export const integrationServiceFactory = ({
     shouldDeleteIntegrationSecrets
   }: TDeleteIntegrationDTO) => {
     const integration = await integrationDAL.findById(id);
-    if (!integration) throw new BadRequestError({ message: "Integration auth not found" });
+    if (!integration) throw new NotFoundError({ message: "Integration auth not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -285,7 +285,7 @@ export const integrationServiceFactory = ({
   const syncIntegration = async ({ id, actorId, actor, actorOrgId, actorAuthMethod }: TSyncIntegrationDTO) => {
     const integration = await integrationDAL.findById(id);
     if (!integration) {
-      throw new BadRequestError({ message: "Integration not found" });
+      throw new NotFoundError({ message: "Integration not found" });
     }
 
     const { permission } = await permissionService.getProjectPermission(

backend/src/services/kms/kms-service.ts

@@ -14,7 +14,7 @@ import { getConfig } from "@app/lib/config/env";
 import { randomSecureBytes } from "@app/lib/crypto";
 import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher";
 import { generateHash } from "@app/lib/crypto/encryption";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
@@ -105,7 +105,7 @@ export const kmsServiceFactory = ({
   const deleteInternalKms = async (kmsId: string, orgId: string, tx?: Knex) => {
     const kms = await kmsDAL.findByIdWithAssociatedKms(kmsId, tx);
     if (kms.isExternal) return;
-    if (kms.orgId !== orgId) throw new BadRequestError({ message: "KMS doesn't belong to organization" });
+    if (kms.orgId !== orgId) throw new ForbiddenRequestError({ message: "KMS doesn't belong to organization" });
     return kmsDAL.deleteById(kmsId, tx);
   };
 
@@ -638,7 +638,7 @@ export const kmsServiceFactory = ({
       }
 
       if (kmsDoc.orgId !== project.orgId) {
-        throw new BadRequestError({
+        throw new ForbiddenRequestError({
           message: "KMS ID does not belong in the organization."
         });
       }
@@ -722,8 +722,8 @@ export const kmsServiceFactory = ({
     }
 
     if (backupProjectId !== projectId) {
-      throw new BadRequestError({
-        message: "Invalid backup for project"
+      throw new ForbiddenRequestError({
+        message: "Backup does not belong to project"
       });
     }
 

backend/src/services/org-admin/org-admin-service.ts

@@ -4,7 +4,7 @@ import { ProjectMembershipRole, ProjectVersion, SecretKeyEncoding } from "@app/d
 import { OrgPermissionAdminConsoleAction, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { TProjectDALFactory } from "../project/project-dal";
 import { assignWorkspaceKeysToMembers } from "../project/project-fns";
@@ -90,7 +90,7 @@ export const orgAdminServiceFactory = ({
     );
 
     const project = await projectDAL.findById(projectId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
 
     if (project.version === ProjectVersion.V1) {
       throw new BadRequestError({ message: "Please upgrade your project on your dashboard" });
@@ -119,22 +119,22 @@ export const orgAdminServiceFactory = ({
     // missing membership thus add admin back as admin to project
     const ghostUser = await projectDAL.findProjectGhostUser(projectId);
     if (!ghostUser) {
-      throw new BadRequestError({
-        message: "Failed to find sudo user"
+      throw new NotFoundError({
+        message: "Failed to find project owner"
       });
     }
 
     const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, projectId);
     if (!ghostUserLatestKey) {
-      throw new BadRequestError({
-        message: "Failed to find sudo user latest key"
+      throw new NotFoundError({
+        message: "Failed to find project owner's latest key"
       });
     }
 
     const bot = await projectBotDAL.findOne({ projectId });
     if (!bot) {
-      throw new BadRequestError({
-        message: "Failed to find bot"
+      throw new NotFoundError({
+        message: "Failed to find project bot"
       });
     }
 
@@ -146,7 +146,7 @@ export const orgAdminServiceFactory = ({
     });
 
     const userEncryptionKey = await userDAL.findUserEncKeyByUserId(actorId);
-    if (!userEncryptionKey) throw new BadRequestError({ message: "user encryption key not found" });
+    if (!userEncryptionKey) throw new NotFoundError({ message: "User encryption key not found" });
     const [newWsMember] = assignWorkspaceKeysToMembers({
       decryptKey: ghostUserLatestKey,
       userPrivateKey: botPrivateKey,

backend/src/services/org/org-role-service.ts

@@ -10,7 +10,7 @@ import {
   OrgPermissionSubjects
 } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { ActorAuthMethod } from "../auth/auth-type";
 import { TOrgRoleDALFactory } from "./org-role-dal";
@@ -91,7 +91,7 @@ export const orgRoleServiceFactory = ({ orgRoleDAL, permissionService }: TOrgRol
       }
       default: {
         const role = await orgRoleDAL.findOne({ id: roleId, orgId });
-        if (!role) throw new BadRequestError({ message: "Role not found", name: "Get role" });
+        if (!role) throw new NotFoundError({ message: "Organization role not found" });
         return role;
       }
     }
@@ -116,7 +116,7 @@ export const orgRoleServiceFactory = ({ orgRoleDAL, permissionService }: TOrgRol
       { id: roleId, orgId },
       { ...data, permissions: data.permissions ? JSON.stringify(data.permissions) : undefined }
     );
-    if (!updatedRole) throw new BadRequestError({ message: "Role not found", name: "Update role" });
+    if (!updatedRole) throw new NotFoundError({ message: "Organization role not found" });
     return updatedRole;
   };
 
@@ -130,7 +130,7 @@ export const orgRoleServiceFactory = ({ orgRoleDAL, permissionService }: TOrgRol
     const { permission } = await permissionService.getUserOrgPermission(userId, orgId, actorAuthMethod, actorOrgId);
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Role);
     const [deletedRole] = await orgRoleDAL.delete({ id: roleId, orgId });
-    if (!deletedRole) throw new BadRequestError({ message: "Role not found", name: "Update role" });
+    if (!deletedRole) throw new NotFoundError({ message: "Organization role not found", name: "Update role" });
 
     return deletedRole;
   };

backend/src/services/org/org-service.ts

@@ -27,7 +27,7 @@ import { getConfig } from "@app/lib/config/env";
 import { generateAsymmetricKeyPair } from "@app/lib/crypto";
 import { generateSymmetricKey, infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { generateUserSrpKeys } from "@app/lib/crypto/srp";
-import { BadRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { isDisposableEmail } from "@app/lib/validator";
@@ -128,7 +128,7 @@ export const orgServiceFactory = ({
   ) => {
     await permissionService.getUserOrgPermission(userId, orgId, actorAuthMethod, actorOrgId);
     const org = await orgDAL.findOrgById(orgId);
-    if (!org) throw new BadRequestError({ name: "Org not found", message: "Organization not found" });
+    if (!org) throw new NotFoundError({ message: "Organization not found" });
     return org;
   };
   /*
@@ -286,8 +286,7 @@ export const orgServiceFactory = ({
     if (authEnforced) {
       const samlCfg = await samlConfigDAL.findEnforceableSamlCfg(orgId);
       if (!samlCfg)
-        throw new BadRequestError({
-          name: "No enforceable SAML config found",
+        throw new NotFoundError({
           message: "No enforceable SAML config found"
         });
     }
@@ -298,7 +297,7 @@ export const orgServiceFactory = ({
       authEnforced,
       scimEnabled
     });
-    if (!org) throw new BadRequestError({ name: "Org not found", message: "Organization not found" });
+    if (!org) throw new NotFoundError({ message: "Organization not found" });
     return org;
   };
   /*
@@ -383,7 +382,10 @@ export const orgServiceFactory = ({
   ) => {
     const { membership } = await permissionService.getUserOrgPermission(userId, orgId, actorAuthMethod, actorOrgId);
     if ((membership.role as OrgMembershipRole) !== OrgMembershipRole.Admin)
-      throw new UnauthorizedError({ name: "Delete org by id", message: "Not an admin" });
+      throw new ForbiddenRequestError({
+        name: "DeleteOrganizationById",
+        message: "Insufficient privileges"
+      });
 
     const organization = await orgDAL.deleteById(orgId);
     if (organization.customerId) {
@@ -413,12 +415,12 @@ export const orgServiceFactory = ({
     });
     if (!foundMembership) throw new NotFoundError({ message: "Failed to find organization membership" });
     if (foundMembership.userId === userId)
-      throw new BadRequestError({ message: "Cannot update own organization membership" });
+      throw new UnauthorizedError({ message: "Cannot update own organization membership" });
 
     const isCustomRole = !Object.values(OrgMembershipRole).includes(role as OrgMembershipRole);
     if (role && isCustomRole) {
       const customRole = await orgRoleDAL.findOne({ slug: role, orgId });
-      if (!customRole) throw new BadRequestError({ name: "Update membership", message: "Role not found" });
+      if (!customRole) throw new BadRequestError({ name: "UpdateMembership", message: "Organization role not found" });
 
       const plan = await licenseService.getPlan(orgId);
       if (!plan?.rbac)
@@ -461,8 +463,8 @@ export const orgServiceFactory = ({
     const isEmailInvalid = await isDisposableEmail(inviteeEmails);
     if (isEmailInvalid) {
       throw new BadRequestError({
-        message: "Provided a disposable email",
-        name: "Org invite"
+        message: "Disposable emails are not allowed",
+        name: "InviteUser"
       });
     }
     const plan = await licenseService.getPlan(orgId);
@@ -483,8 +485,8 @@ export const orgServiceFactory = ({
         })
       : [];
     if (projectsToInvite.length !== invitedProjects?.length) {
-      throw new UnauthorizedError({
-        message: "One or more project doesn't have access to"
+      throw new ForbiddenRequestError({
+        message: "Access denied to one or more of the specified projects"
       });
     }
 
@@ -495,7 +497,7 @@ export const orgServiceFactory = ({
     }
 
     const mailsForOrgInvitation: { email: string; userId: string; firstName: string; lastName: string }[] = [];
-    const mailsForProjectInvitaion: { email: string[]; projectName: string }[] = [];
+    const mailsForProjectInvitation: { email: string[]; projectName: string }[] = [];
     const newProjectMemberships: TProjectMemberships[] = [];
     await orgDAL.transaction(async (tx) => {
       const users: Pick<TUsers, "id" | "firstName" | "lastName" | "email" | "username">[] = [];
@@ -563,6 +565,7 @@ export const orgServiceFactory = ({
           if (plan?.slug !== "enterprise" && plan?.memberLimit && plan.membersUsed >= plan.memberLimit) {
             // limit imposed on number of members allowed / number of members used exceeds the number of members allowed
             throw new BadRequestError({
+              name: "InviteUser",
               message: "Failed to invite member due to member limit reached. Upgrade plan to invite more members."
             });
           }
@@ -570,12 +573,14 @@ export const orgServiceFactory = ({
           if (plan?.slug !== "enterprise" && plan?.identityLimit && plan.identitiesUsed >= plan.identityLimit) {
             // limit imposed on number of identities allowed / number of identities used exceeds the number of identities allowed
             throw new BadRequestError({
+              name: "InviteUser",
               message: "Failed to invite member due to member limit reached. Upgrade plan to invite more members."
             });
           }
 
           if (org?.authEnforced) {
-            throw new BadRequestError({
+            throw new ForbiddenRequestError({
+              name: "InviteUser",
               message: "Failed to invite user due to org-level auth enforced for organization"
             });
           }
@@ -587,7 +592,7 @@ export const orgServiceFactory = ({
           if (isCustomOrgRole) {
             const customRole = await orgRoleDAL.findOne({ slug: organizationRoleSlug, orgId });
             if (!customRole)
-              throw new BadRequestError({ name: "Invite membership", message: "Organization role not found" });
+              throw new NotFoundError({ name: "InviteUser", message: "Custom organization role not found" });
             roleId = customRole.id;
           }
 
@@ -660,6 +665,7 @@ export const orgServiceFactory = ({
         if (hasCustomRole) {
           if (!plan?.rbac)
             throw new BadRequestError({
+              name: "InviteUser",
               message:
                 "Failed to assign custom role due to RBAC restriction. Upgrade plan to assign custom role to member."
             });
@@ -671,29 +677,33 @@ export const orgServiceFactory = ({
               $in: { slug: customProjectRoles.map((role) => role) }
             })
           : [];
-        if (customRoles.length !== customProjectRoles.length)
-          throw new BadRequestError({ message: "Custom role not found" });
+        if (customRoles.length !== customProjectRoles.length) {
+          throw new NotFoundError({ name: "InviteUser", message: "Custom project role not found" });
+        }
 
         const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug);
 
         const ghostUser = await projectDAL.findProjectGhostUser(projectId, tx);
         if (!ghostUser) {
-          throw new BadRequestError({
-            message: "Failed to find sudo user"
+          throw new NotFoundError({
+            name: "InviteUser",
+            message: "Failed to find project owner"
           });
         }
 
         const ghostUserLatestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.id, projectId, tx);
         if (!ghostUserLatestKey) {
-          throw new BadRequestError({
-            message: "Failed to find sudo user latest key"
+          throw new NotFoundError({
+            name: "InviteUser",
+            message: "Failed to find project owner's latest key"
           });
         }
 
         const bot = await projectBotDAL.findOne({ projectId }, tx);
         if (!bot) {
-          throw new BadRequestError({
-            message: "Failed to find bot"
+          throw new NotFoundError({
+            name: "InviteUser",
+            message: "Failed to find project bot"
           });
         }
 
@@ -746,7 +756,7 @@ export const orgServiceFactory = ({
           })),
           tx
         );
-        mailsForProjectInvitaion.push({
+        mailsForProjectInvitation.push({
           email: userWithEncryptionKeyInvitedToProject
             .filter((el) => !userIdsWithOrgInvitation.has(el.userId))
             .map((el) => el.email || el.username),
@@ -790,7 +800,7 @@ export const orgServiceFactory = ({
     );
 
     await Promise.allSettled(
-      mailsForProjectInvitaion
+      mailsForProjectInvitation
         .filter((el) => Boolean(el.email.length))
         .map(async (el) => {
           return smtpService.sendMail({
@@ -819,17 +829,17 @@ export const orgServiceFactory = ({
   const verifyUserToOrg = async ({ orgId, email, code }: TVerifyUserToOrgDTO) => {
     const user = await userDAL.findUserByUsername(email);
     if (!user) {
-      throw new BadRequestError({ message: "Invalid request", name: "Verify user to org" });
+      throw new NotFoundError({ message: "User not found" });
     }
     const [orgMembership] = await orgDAL.findMembership({
       [`${TableName.OrgMembership}.userId` as "userId"]: user.id,
       status: OrgMembershipStatus.Invited,
       [`${TableName.OrgMembership}.orgId` as "orgId"]: orgId
     });
+
     if (!orgMembership)
-      throw new BadRequestError({
-        message: "Failed to find invitation",
-        name: "Verify user to org"
+      throw new NotFoundError({
+        message: "No pending invitation found"
       });
 
     await tokenService.validateTokenForUser({
@@ -881,8 +891,12 @@ export const orgServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
 
     const membership = await orgMembershipDAL.findOrgMembershipById(membershipId);
-    if (!membership) throw new NotFoundError({ message: "Failed to find organization membership" });
-    if (membership.orgId !== orgId) throw new NotFoundError({ message: "Failed to find organization membership" });
+    if (!membership) {
+      throw new NotFoundError({ message: "Organization membership not found" });
+    }
+    if (membership.orgId !== orgId) {
+      throw new ForbiddenRequestError({ message: "Membership does not belong to organization" });
+    }
 
     return membership;
   };
@@ -923,7 +937,9 @@ export const orgServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
 
     const membership = await orgMembershipDAL.findOrgMembershipById(orgMembershipId);
-    if (!membership) throw new NotFoundError({ message: "Failed to find organization membership" });
+    if (!membership) {
+      throw new NotFoundError({ message: "Organization membership not found" });
+    }
     if (membership.orgId !== orgId) throw new NotFoundError({ message: "Failed to find organization membership" });
 
     const projectMemberships = await projectMembershipDAL.findProjectMembershipsByUserId(orgId, membership.user.id);

backend/src/services/pki-alert/pki-alert-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { TPkiCollectionDALFactory } from "@app/services/pki-collection/pki-collection-dal";
 import { pkiItemTypeToNameMap } from "@app/services/pki-collection/pki-collection-types";
@@ -86,7 +86,7 @@ export const pkiAlertServiceFactory = ({
     const pkiCollection = await pkiCollectionDAL.findById(pkiCollectionId);
     if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
     if (pkiCollection.projectId !== projectId)
-      throw new UnauthorizedError({ message: "PKI collection not found in project" });
+      throw new ForbiddenRequestError({ message: "PKI collection does not belong to the specified project." });
 
     const alert = await pkiAlertDAL.create({
       projectId,
@@ -141,8 +141,9 @@ export const pkiAlertServiceFactory = ({
     if (pkiCollectionId) {
       const pkiCollection = await pkiCollectionDAL.findById(pkiCollectionId);
       if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
-      if (pkiCollection.projectId !== alert.projectId)
-        throw new UnauthorizedError({ message: "PKI collection not found in project" });
+      if (pkiCollection.projectId !== alert.projectId) {
+        throw new ForbiddenRequestError({ message: "PKI collection does not belong to the specified project." });
+      }
     }
 
     alert = await pkiAlertDAL.updateById(alertId, {

backend/src/services/project-bot/project-bot-fns.ts

@@ -6,7 +6,7 @@ import {
   infisicalSymmetricDecrypt,
   infisicalSymmetricEncypt
 } from "@app/lib/crypto/encryption";
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal";
 
 import { TProjectDALFactory } from "../project/project-dal";
@@ -27,7 +27,7 @@ export const getBotKeyFnFactory = (
   const getBotKeyFn = async (projectId: string) => {
     const project = await projectDAL.findById(projectId);
     if (!project)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project not found during bot lookup. Are you sure you are using the correct project ID?"
       });
 
@@ -39,7 +39,7 @@ export const getBotKeyFnFactory = (
     if (!bot || !bot.isActive || !bot.encryptedProjectKey || !bot.encryptedProjectKeyNonce) {
       // trying to set bot automatically
       const projectV1Keys = await projectBotDAL.findProjectUserWorkspaceKey(projectId);
-      if (!projectV1Keys) throw new BadRequestError({ message: "Bot not found. Please ask admin user to login" });
+      if (!projectV1Keys) throw new NotFoundError({ message: "Bot not found. Please ask admin user to login" });
 
       let userPrivateKey = "";
       if (

backend/src/services/project-bot/project-bot-service.ts

@@ -5,7 +5,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { generateAsymmetricKeyPair } from "@app/lib/crypto";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectBotDALFactory } from "./project-bot-dal";
@@ -91,7 +91,7 @@ export const projectBotServiceFactory = ({
       const bot = await projectBotDAL.findProjectByBotId(botId);
       return bot;
     } catch (e) {
-      throw new BadRequestError({ message: "Failed to find bot by ID" });
+      throw new NotFoundError({ message: "Failed to find bot by ID" });
     }
   };
 
@@ -105,7 +105,7 @@ export const projectBotServiceFactory = ({
     isActive
   }: TSetActiveStateDTO) => {
     const bot = await projectBotDAL.findById(botId);
-    if (!bot) throw new BadRequestError({ message: "Bot not found" });
+    if (!bot) throw new NotFoundError({ message: "Bot not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -119,7 +119,7 @@ export const projectBotServiceFactory = ({
     const project = await projectBotDAL.findProjectByBotId(botId);
 
     if (!project) {
-      throw new BadRequestError({ message: "Failed to find project by bot ID" });
+      throw new NotFoundError({ message: "Failed to find project by bot ID" });
     }
 
     if (project.version === ProjectVersion.V2) {
@@ -128,7 +128,7 @@ export const projectBotServiceFactory = ({
 
     if (isActive) {
       if (!botKey?.nonce || !botKey?.encryptedKey) {
-        throw new BadRequestError({ message: "Failed to set bot active - missing bot key" });
+        throw new NotFoundError({ message: "Bot key not found, failed to set bot active" });
       }
       const doc = await projectBotDAL.updateById(botId, {
         isActive: true,

backend/src/services/project-env/project-env-service.ts

@@ -50,7 +50,7 @@ export const projectEnvServiceFactory = ({
     if (existingEnv)
       throw new BadRequestError({
         message: "Environment with slug already exist",
-        name: "Create envv"
+        name: "CreateEnvironment"
       });
 
     const project = await projectDAL.findById(projectId);
@@ -94,14 +94,14 @@ export const projectEnvServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Environments);
 
     const oldEnv = await projectEnvDAL.findOne({ id, projectId });
-    if (!oldEnv) throw new BadRequestError({ message: "Environment not found" });
+    if (!oldEnv) throw new NotFoundError({ message: "Environment not found" });
 
     if (slug) {
       const existingEnv = await projectEnvDAL.findOne({ slug, projectId });
       if (existingEnv && existingEnv.id !== id) {
         throw new BadRequestError({
           message: "Environment with slug already exist",
-          name: "Create envv"
+          name: "UpdateEnvironment"
         });
       }
     }
@@ -128,9 +128,9 @@ export const projectEnvServiceFactory = ({
     const env = await projectEnvDAL.transaction(async (tx) => {
       const [doc] = await projectEnvDAL.delete({ id, projectId }, tx);
       if (!doc)
-        throw new BadRequestError({
+        throw new NotFoundError({
           message: "Env doesn't exist",
-          name: "Re-order env"
+          name: "DeleteEnvironment"
         });
 
       await projectEnvDAL.updateAllPosition(projectId, doc.position, -1, tx);

backend/src/services/project-membership/project-membership-service.ts

@@ -8,7 +8,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 
 import { TUserGroupMembershipDALFactory } from "../../ee/services/group/user-group-membership-dal";
@@ -143,7 +143,7 @@ export const projectMembershipServiceFactory = ({
     sendEmails = true
   }: TAddUsersToWorkspaceDTO) => {
     const project = await projectDAL.findById(projectId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -236,10 +236,7 @@ export const projectMembershipServiceFactory = ({
 
     const membershipUser = await userDAL.findUserByProjectMembershipId(membershipId);
     if (membershipUser?.isGhost || membershipUser?.projectId !== projectId) {
-      throw new BadRequestError({
-        message: "Unauthorized member update",
-        name: "Update project membership"
-      });
+      throw new ForbiddenRequestError({ message: "Forbidden member update" });
     }
 
     // validate custom roles input
@@ -261,7 +258,9 @@ export const projectMembershipServiceFactory = ({
           $in: { slug: customInputRoles.map(({ role }) => role) }
         })
       : [];
-    if (customRoles.length !== customInputRoles.length) throw new BadRequestError({ message: "Custom role not found" });
+    if (customRoles.length !== customInputRoles.length) {
+      throw new NotFoundError({ message: "Custom project roles not found" });
+    }
     const customRolesGroupBySlug = groupBy(customRoles, ({ slug }) => slug);
 
     const sanitizedProjectMembershipRoles = roles.map((inputRole) => {
@@ -317,9 +316,9 @@ export const projectMembershipServiceFactory = ({
     const member = await userDAL.findUserByProjectMembershipId(membershipId);
 
     if (member?.isGhost) {
-      throw new BadRequestError({
-        message: "Unauthorized member delete",
-        name: "Delete project membership"
+      throw new ForbiddenRequestError({
+        message: "Forbidden membership deletion",
+        name: "DeleteProjectMembership"
       });
     }
 
@@ -352,9 +351,8 @@ export const projectMembershipServiceFactory = ({
     const project = await projectDAL.findById(projectId);
 
     if (!project) {
-      throw new BadRequestError({
-        message: "Project not found",
-        name: "Delete project membership"
+      throw new NotFoundError({
+        message: "Project not found"
       });
     }
 
@@ -428,7 +426,7 @@ export const projectMembershipServiceFactory = ({
     }
 
     const project = await projectDAL.findById(projectId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
 
     if (project.version === ProjectVersion.V1) {
       throw new BadRequestError({
@@ -439,7 +437,7 @@ export const projectMembershipServiceFactory = ({
     const projectMembers = await projectMembershipDAL.findAllProjectMembers(projectId);
 
     if (!projectMembers?.length) {
-      throw new BadRequestError({ message: "Failed to find project members" });
+      throw new NotFoundError({ message: "Failed to find project members" });
     }
 
     if (projectMembers.length < 2) {

backend/src/services/project-role/project-role-service.ts

@@ -10,7 +10,7 @@ import {
   ProjectPermissionSub,
   validateProjectPermissions
 } from "@app/ee/services/permission/project-permission";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { ActorAuthMethod } from "../auth/auth-type";
 import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/identity-project-membership-role-dal";
@@ -44,7 +44,7 @@ export const projectRoleServiceFactory = ({
 }: TProjectRoleServiceFactoryDep) => {
   const createRole = async ({ projectSlug, data, actor, actorId, actorAuthMethod, actorOrgId }: TCreateRoleDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
     const projectId = project.id;
 
     const { permission } = await permissionService.getProjectPermission(
@@ -56,7 +56,9 @@ export const projectRoleServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Role);
     const existingRole = await projectRoleDAL.findOne({ slug: data.slug, projectId });
-    if (existingRole) throw new BadRequestError({ name: "Create Role", message: "Duplicate role" });
+    if (existingRole) {
+      throw new BadRequestError({ name: "Create Role", message: "Project role with same slug already exists" });
+    }
 
     validateProjectPermissions(data.permissions);
 
@@ -76,7 +78,7 @@ export const projectRoleServiceFactory = ({
     roleSlug
   }: TGetRoleBySlugDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
     const projectId = project.id;
 
     const { permission } = await permissionService.getProjectPermission(
@@ -93,7 +95,7 @@ export const projectRoleServiceFactory = ({
     }
 
     const customRole = await projectRoleDAL.findOne({ slug: roleSlug, projectId });
-    if (!customRole) throw new BadRequestError({ message: "Role not found" });
+    if (!customRole) throw new NotFoundError({ message: "Project role not found" });
     return { ...customRole, permissions: unpackPermissions(customRole.permissions) };
   };
 
@@ -107,7 +109,7 @@ export const projectRoleServiceFactory = ({
     data
   }: TUpdateRoleDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
     const projectId = project.id;
 
     const { permission } = await permissionService.getProjectPermission(
@@ -122,7 +124,7 @@ export const projectRoleServiceFactory = ({
     if (data?.slug) {
       const existingRole = await projectRoleDAL.findOne({ slug: data.slug, projectId });
       if (existingRole && existingRole.id !== roleId)
-        throw new BadRequestError({ name: "Update Role", message: "Duplicate role" });
+        throw new BadRequestError({ name: "Update Role", message: "Project role with the same slug already exists" });
     }
 
     if (data.permissions) {
@@ -136,13 +138,13 @@ export const projectRoleServiceFactory = ({
         permissions: data.permissions ? data.permissions : undefined
       }
     );
-    if (!updatedRole) throw new BadRequestError({ message: "Role not found", name: "Update role" });
+    if (!updatedRole) throw new NotFoundError({ message: "Project role not found", name: "Update role" });
     return { ...updatedRole, permissions: unpackPermissions(updatedRole.permissions) };
   };
 
   const deleteRole = async ({ actor, actorId, actorAuthMethod, actorOrgId, projectSlug, roleId }: TDeleteRoleDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-    if (!project) throw new BadRequestError({ message: "Project not found" });
+    if (!project) throw new NotFoundError({ message: "Project not found" });
     const projectId = project.id;
 
     const { permission } = await permissionService.getProjectPermission(
@@ -171,7 +173,7 @@ export const projectRoleServiceFactory = ({
     }
 
     const [deletedRole] = await projectRoleDAL.delete({ id: roleId, projectId });
-    if (!deletedRole) throw new BadRequestError({ message: "Role not found", name: "Delete role" });
+    if (!deletedRole) throw new NotFoundError({ message: "Project role not found", name: "Delete role" });
 
     return { ...deletedRole, permissions: unpackPermissions(deletedRole.permissions) };
   };

backend/src/services/project/project-dal.ts

@@ -2,7 +2,7 @@ import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
 import { ProjectsSchema, ProjectUpgradeStatus, ProjectVersion, TableName, TProjectsUpdate } from "@app/db/schemas";
-import { BadRequestError, DatabaseError } from "@app/lib/errors";
+import { BadRequestError, DatabaseError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
 import { Filter, ProjectFilterType } from "./project-types";
@@ -186,7 +186,7 @@ export const projectDALFactory = (db: TDbClient) => {
       })?.[0];
 
       if (!project) {
-        throw new BadRequestError({ message: "Project not found" });
+        throw new NotFoundError({ message: "Project not found" });
       }
 
       return project;
@@ -198,7 +198,7 @@ export const projectDALFactory = (db: TDbClient) => {
   const findProjectBySlug = async (slug: string, orgId: string | undefined) => {
     try {
       if (!orgId) {
-        throw new BadRequestError({ message: "Organization ID is required when querying with slugs" });
+        throw new UnauthorizedError({ message: "Organization ID is required when querying with slugs" });
       }
 
       const projects = await db
@@ -235,7 +235,7 @@ export const projectDALFactory = (db: TDbClient) => {
       })?.[0];
 
       if (!project) {
-        throw new BadRequestError({ message: "Project not found" });
+        throw new NotFoundError({ message: "Project not found" });
       }
 
       return project;
@@ -251,7 +251,7 @@ export const projectDALFactory = (db: TDbClient) => {
       }
       if (filter.type === ProjectFilterType.SLUG) {
         if (!filter.orgId) {
-          throw new BadRequestError({
+          throw new UnauthorizedError({
             message: "Organization ID is required when querying with slugs"
           });
         }
@@ -295,7 +295,7 @@ export const projectDALFactory = (db: TDbClient) => {
       .first();
 
     if (!project) {
-      throw new BadRequestError({ message: "Project not found" });
+      throw new NotFoundError({ message: "Project not found" });
     }
 
     return {

backend/src/services/project/project-fns.ts

@@ -2,7 +2,7 @@ import crypto from "crypto";
 
 import { ProjectVersion, TProjects } from "@app/db/schemas";
 import { decryptAsymmetric, encryptAsymmetric } from "@app/lib/crypto";
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
@@ -75,7 +75,7 @@ export const getProjectKmsCertificateKeyId = async ({
   const keyId = await projectDAL.transaction(async (tx) => {
     const project = await projectDAL.findOne({ id: projectId }, tx);
     if (!project) {
-      throw new BadRequestError({ message: "Project not found" });
+      throw new NotFoundError({ message: "Project not found" });
     }
 
     if (!project.kmsCertificateKeyId) {

backend/src/services/project/project-service.ts

@@ -175,7 +175,7 @@ export const projectServiceFactory = ({
         const kms = await kmsService.getKmsById(kmsKeyId, tx);
 
         if (kms.orgId !== organization.id) {
-          throw new BadRequestError({
+          throw new ForbiddenRequestError({
             message: "KMS does not belong in the organization"
           });
         }
@@ -321,7 +321,7 @@ export const projectServiceFactory = ({
 
         // If identity org membership not found, throw error
         if (!identityOrgMembership) {
-          throw new BadRequestError({
+          throw new NotFoundError({
             message: `Failed to find identity with id ${actorId}`
           });
         }
@@ -490,7 +490,7 @@ export const projectServiceFactory = ({
   }: TUpdateProjectVersionLimitDTO) => {
     const project = await projectDAL.findProjectBySlug(workspaceSlug, actorOrgId);
     if (!project) {
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project not found"
       });
     }
@@ -504,7 +504,9 @@ export const projectServiceFactory = ({
     );
 
     if (!hasRole(ProjectMembershipRole.Admin))
-      throw new BadRequestError({ message: "Only admins are allowed to take this action" });
+      throw new ForbiddenRequestError({
+        message: "Insufficient privileges, only admins are allowed to take this action"
+      });
 
     return projectDAL.updateById(project.id, { pitVersionLimit });
   };
@@ -533,7 +535,9 @@ export const projectServiceFactory = ({
     );
 
     if (!hasRole(ProjectMembershipRole.Admin)) {
-      throw new BadRequestError({ message: "Only admins are allowed to take this action" });
+      throw new ForbiddenRequestError({
+        message: "Insufficient privileges, only admins are allowed to take this action"
+      });
     }
 
     const plan = await licenseService.getPlan(project.orgId);
@@ -624,7 +628,7 @@ export const projectServiceFactory = ({
     const project = await projectDAL.findProjectById(projectId);
 
     if (!project) {
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: `Project with id ${projectId} not found`
       });
     }
@@ -905,9 +909,7 @@ export const projectServiceFactory = ({
     );
 
     if (!membership) {
-      throw new ForbiddenRequestError({
-        message: "User is not a member of the project"
-      });
+      throw new ForbiddenRequestError({ message: "You are not a member of this project" });
     }
 
     const kmsKeyId = await kmsService.getProjectSecretManagerKmsKeyId(projectId);
@@ -982,7 +984,7 @@ export const projectServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
 
     if (slackIntegration.orgId !== project.orgId) {
-      throw new BadRequestError({
+      throw new ForbiddenRequestError({
         message: "Selected slack integration is not in the same organization"
       });
     }

backend/src/services/secret-blind-index/secret-blind-index-service.ts

@@ -1,6 +1,6 @@
 import { ProjectMembershipRole } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 
 import { TSecretDALFactory } from "../secret/secret-dal";
 import { generateSecretBlindIndexBySalt } from "../secret/secret-fns";
@@ -52,7 +52,7 @@ export const secretBlindIndexServiceFactory = ({
       actorOrgId
     );
     if (!hasRole(ProjectMembershipRole.Admin)) {
-      throw new UnauthorizedError({ message: "User must be admin" });
+      throw new ForbiddenRequestError({ message: "Insufficient privileges, user must be admin" });
     }
 
     const secrets = await secretBlindIndexDAL.findAllSecretsByProjectId(projectId);
@@ -75,17 +75,17 @@ export const secretBlindIndexServiceFactory = ({
       actorOrgId
     );
     if (!hasRole(ProjectMembershipRole.Admin)) {
-      throw new UnauthorizedError({ message: "User must be admin" });
+      throw new ForbiddenRequestError({ message: "Insufficient privileges, user must be admin" });
     }
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" });
 
     const secrets = await secretBlindIndexDAL.findSecretsByProjectId(
       projectId,
       secretsToUpdate.map(({ secretId }) => secretId)
     );
-    if (secrets.length !== secretsToUpdate.length) throw new BadRequestError({ message: "Secret not found" });
+    if (secrets.length !== secretsToUpdate.length) throw new NotFoundError({ message: "Secret not found" });
 
     const operations = await Promise.all(
       secretsToUpdate.map(async ({ secretName, secretId: id }) => {

backend/src/services/secret-folder/secret-folder-service.ts

@@ -76,7 +76,7 @@ export const secretFolderServiceFactory = ({
     }
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
-    if (!env) throw new BadRequestError({ message: "Environment not found", name: "Create folder" });
+    if (!env) throw new NotFoundError({ message: "Environment not found", name: "Create folder" });
 
     const folder = await folderDAL.transaction(async (tx) => {
       // the logic is simple we need to avoid creating same folder in same path multiple times
@@ -86,7 +86,7 @@ export const secretFolderServiceFactory = ({
       const pathWithFolder = path.join(secretPath, name);
       const parentFolder = await folderDAL.findClosestFolder(projectId, environment, pathWithFolder, tx);
       // no folder found is not possible root should be their
-      if (!parentFolder) throw new BadRequestError({ message: "Secret path not found" });
+      if (!parentFolder) throw new NotFoundError({ message: "Secret path not found" });
       // exact folder
       if (parentFolder.path === pathWithFolder) return parentFolder;
 
@@ -149,7 +149,7 @@ export const secretFolderServiceFactory = ({
   }: TUpdateManyFoldersDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) {
-      throw new BadRequestError({ message: "Project not found" });
+      throw new NotFoundError({ message: "Project not found" });
     }
 
     const { permission } = await permissionService.getProjectPermission(
@@ -184,12 +184,12 @@ export const secretFolderServiceFactory = ({
 
           const parentFolder = await folderDAL.findBySecretPath(project.id, environment, secretPath);
           if (!parentFolder) {
-            throw new BadRequestError({ message: "Secret path not found", name: "Batch update folder" });
+            throw new NotFoundError({ message: "Secret path not found", name: "Batch update folder" });
           }
 
           const env = await projectEnvDAL.findOne({ projectId: project.id, slug: environment });
           if (!env) {
-            throw new BadRequestError({ message: "Environment not found", name: "Batch update folder" });
+            throw new NotFoundError({ message: "Environment not found", name: "Batch update folder" });
           }
           const folder = await folderDAL
             .findOne({ envId: env.id, id, parentId: parentFolder.id })
@@ -198,7 +198,7 @@ export const secretFolderServiceFactory = ({
             .catch(() => folderDAL.findOne({ envId: env.id, name: id, parentId: parentFolder.id }));
 
           if (!folder) {
-            throw new BadRequestError({ message: "Folder not found" });
+            throw new NotFoundError({ message: "Folder not found" });
           }
           if (name !== folder.name) {
             // ensure that new folder name is unique
@@ -231,7 +231,7 @@ export const secretFolderServiceFactory = ({
             tx
           );
           if (!doc) {
-            throw new BadRequestError({ message: "Folder not found", name: "Batch update folder" });
+            throw new NotFoundError({ message: "Folder not found", name: "Batch update folder" });
           }
 
           return { oldFolder: folder, newFolder: doc };
@@ -283,17 +283,17 @@ export const secretFolderServiceFactory = ({
     }
 
     const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!parentFolder) throw new BadRequestError({ message: "Secret path not found" });
+    if (!parentFolder) throw new NotFoundError({ message: "Secret path not found" });
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
-    if (!env) throw new BadRequestError({ message: "Environment not found", name: "Update folder" });
+    if (!env) throw new NotFoundError({ message: "Environment not found", name: "Update folder" });
     const folder = await folderDAL
       .findOne({ envId: env.id, id, parentId: parentFolder.id, isReserved: false })
       // now folder api accepts id based change
       // this is for cli backward compatiability and when cli removes this, we will remove this logic
       .catch(() => folderDAL.findOne({ envId: env.id, name: id, parentId: parentFolder.id }));
 
-    if (!folder) throw new BadRequestError({ message: "Folder not found" });
+    if (!folder) throw new NotFoundError({ message: "Folder not found" });
     if (name !== folder.name) {
       // ensure that new folder name is unique
       const folderToCheck = await folderDAL.findOne({
@@ -325,7 +325,7 @@ export const secretFolderServiceFactory = ({
         },
         tx
       );
-      if (!doc) throw new BadRequestError({ message: "Folder not found", name: "Update folder" });
+      if (!doc) throw new NotFoundError({ message: "Folder not found", name: "Update folder" });
       return doc;
     });
 
@@ -367,11 +367,11 @@ export const secretFolderServiceFactory = ({
     }
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
-    if (!env) throw new BadRequestError({ message: "Environment not found", name: "Create folder" });
+    if (!env) throw new NotFoundError({ message: "Environment not found", name: "Create folder" });
 
     const folder = await folderDAL.transaction(async (tx) => {
       const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath, tx);
-      if (!parentFolder) throw new BadRequestError({ message: "Secret path not found" });
+      if (!parentFolder) throw new NotFoundError({ message: "Secret path not found" });
 
       const [doc] = await folderDAL.delete(
         {
@@ -382,7 +382,7 @@ export const secretFolderServiceFactory = ({
         },
         tx
       );
-      if (!doc) throw new BadRequestError({ message: "Folder not found", name: "Delete folder" });
+      if (!doc) throw new NotFoundError({ message: "Folder not found", name: "Delete folder" });
       return doc;
     });
 
@@ -409,7 +409,7 @@ export const secretFolderServiceFactory = ({
     await permissionService.getProjectPermission(actor, actorId, projectId, actorAuthMethod, actorOrgId);
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
-    if (!env) throw new BadRequestError({ message: "Environment not found", name: "get folders" });
+    if (!env) throw new NotFoundError({ message: "Environment not found", name: "get folders" });
 
     const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!parentFolder) return [];
@@ -448,7 +448,7 @@ export const secretFolderServiceFactory = ({
     const envs = await projectEnvDAL.findBySlugs(projectId, environments);
 
     if (!envs.length)
-      throw new BadRequestError({ message: "Environment(s) not found", name: "get project folder count" });
+      throw new NotFoundError({ message: "Environment(s) not found", name: "get project folder count" });
 
     const parentFolders = await folderDAL.findBySecretPathMultiEnv(projectId, environments, secretPath);
     if (!parentFolders.length) return [];
@@ -480,7 +480,7 @@ export const secretFolderServiceFactory = ({
     const envs = await projectEnvDAL.findBySlugs(projectId, environments);
 
     if (!envs.length)
-      throw new BadRequestError({ message: "Environment(s) not found", name: "get project folder count" });
+      throw new NotFoundError({ message: "Environment(s) not found", name: "get project folder count" });
 
     const parentFolders = await folderDAL.findBySecretPathMultiEnv(projectId, environments, secretPath);
     if (!parentFolders.length) return 0;

backend/src/services/secret-import/secret-import-service.ts

@@ -106,10 +106,10 @@ export const secretImportServiceFactory = ({
     await projectDAL.checkProjectUpgradeStatus(projectId);
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Create import" });
+    if (!folder) throw new NotFoundError({ message: "Folder not found", name: "Create import" });
 
     const [importEnv] = await projectEnvDAL.findBySlugs(projectId, [data.environment]);
-    if (!importEnv) throw new BadRequestError({ error: "Imported env not found", name: "Create import" });
+    if (!importEnv) throw new NotFoundError({ error: "Imported env not found", name: "Create import" });
 
     const sourceFolder = await folderDAL.findBySecretPath(projectId, data.environment, data.path);
     if (sourceFolder) {
@@ -118,7 +118,7 @@ export const secretImportServiceFactory = ({
         importEnv: folder.environment.id,
         importPath: secretPath
       });
-      if (existingImport) throw new BadRequestError({ message: "Cyclic import not allowed" });
+      if (existingImport) throw new NotFoundError({ message: "Cyclic import not allowed" });
     }
 
     const secImport = await secretImportDAL.transaction(async (tx) => {
@@ -194,7 +194,7 @@ export const secretImportServiceFactory = ({
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Update import" });
+    if (!folder) throw new NotFoundError({ message: "Folder not found", name: "Update import" });
 
     const secImpDoc = await secretImportDAL.findOne({ folderId: folder.id, id });
     if (!secImpDoc) throw ERR_SEC_IMP_NOT_FOUND;
@@ -202,7 +202,7 @@ export const secretImportServiceFactory = ({
     const importedEnv = data.environment // this is get env information of new one or old one
       ? (await projectEnvDAL.findBySlugs(projectId, [data.environment]))?.[0]
       : await projectEnvDAL.findById(secImpDoc.importEnv);
-    if (!importedEnv) throw new BadRequestError({ error: "Imported env not found", name: "Create import" });
+    if (!importedEnv) throw new NotFoundError({ error: "Imported env not found", name: "Create import" });
 
     const sourceFolder = await folderDAL.findBySecretPath(
       projectId,
@@ -215,7 +215,7 @@ export const secretImportServiceFactory = ({
         importEnv: folder.environment.id,
         importPath: secretPath
       });
-      if (existingImport) throw new BadRequestError({ message: "Cyclic import not allowed" });
+      if (existingImport) throw new NotFoundError({ message: "Cyclic import not allowed" });
     }
 
     const updatedSecImport = await secretImportDAL.transaction(async (tx) => {
@@ -280,11 +280,11 @@ export const secretImportServiceFactory = ({
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Delete import" });
+    if (!folder) throw new NotFoundError({ message: "Folder not found", name: "Delete import" });
 
     const secImport = await secretImportDAL.transaction(async (tx) => {
       const [doc] = await secretImportDAL.delete({ folderId: folder.id, id }, tx);
-      if (!doc) throw new BadRequestError({ name: "Sec imp del", message: "Secret import doc not found" });
+      if (!doc) throw new NotFoundError({ message: "Secret import not found" });
       if (doc.isReplication) {
         const replicationFolderPath = path.join(secretPath, getReplicationFolderName(doc.id));
         const replicatedFolder = await folderDAL.findBySecretPath(projectId, environment, replicationFolderPath, tx);
@@ -306,7 +306,7 @@ export const secretImportServiceFactory = ({
       }
 
       const importEnv = await projectEnvDAL.findById(doc.importEnv);
-      if (!importEnv) throw new BadRequestError({ error: "Imported env not found", name: "Create import" });
+      if (!importEnv) throw new NotFoundError({ error: "Imported env not found" });
       return { ...doc, importEnv };
     });
 
@@ -353,13 +353,13 @@ export const secretImportServiceFactory = ({
     }
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Update import" });
+    if (!folder) throw new NotFoundError({ message: "Folder not found" });
 
     const [secretImportDoc] = await secretImportDAL.find({
       folderId: folder.id,
       [`${TableName.SecretImport}.id` as "id"]: secretImportDocId
     });
-    if (!secretImportDoc) throw new BadRequestError({ message: "Failed to find secret import" });
+    if (!secretImportDoc) throw new NotFoundError({ message: "Failed to find secret import" });
 
     if (!secretImportDoc.isReplication) throw new BadRequestError({ message: "Import is not in replication mode" });
 
@@ -449,7 +449,7 @@ export const secretImportServiceFactory = ({
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Get imports" });
+    if (!folder) throw new NotFoundError({ message: "Folder not found" });
 
     const secImports = await secretImportDAL.find({ folderId: folder.id, search, limit, offset });
     return secImports;
@@ -546,7 +546,7 @@ export const secretImportServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });

backend/src/services/secret-sharing/secret-sharing-service.ts

@@ -45,7 +45,7 @@ export const secretSharingServiceFactory = ({
     expiresAfterViews
   }: TCreateSharedSecretDTO) => {
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    if (!permission) throw new UnauthorizedError({ name: "User not in org" });
+    if (!permission) throw new ForbiddenRequestError({ name: "User is not a part of the specified organization" });
 
     if (new Date(expiresAt) < new Date()) {
       throw new BadRequestError({ message: "Expiration date cannot be in the past" });
@@ -132,7 +132,7 @@ export const secretSharingServiceFactory = ({
     offset,
     limit
   }: TGetSharedSecretsDTO) => {
-    if (!actorOrgId) throw new BadRequestError({ message: "Failed to create group without organization" });
+    if (!actorOrgId) throw new ForbiddenRequestError();
 
     const { permission } = await permissionService.getOrgPermission(
       actor,
@@ -141,7 +141,7 @@ export const secretSharingServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    if (!permission) throw new UnauthorizedError({ name: "User not in org" });
+    if (!permission) throw new ForbiddenRequestError({ name: "User does not belong to the specified organization" });
 
     const secrets = await secretSharingDAL.find(
       {
@@ -191,7 +191,7 @@ export const secretSharingServiceFactory = ({
     const orgName = sharedSecret.orgId ? (await orgDAL.findOrgById(sharedSecret.orgId))?.name : "";
 
     if (accessType === SecretSharingAccessType.Organization && orgId !== sharedSecret.orgId)
-      throw new UnauthorizedError();
+      throw new ForbiddenRequestError();
 
     // all secrets pass through here, meaning we check if its expired first and then check if it needs verification
     // or can be safely sent to the client.
@@ -240,7 +240,7 @@ export const secretSharingServiceFactory = ({
   const deleteSharedSecretById = async (deleteSharedSecretInput: TDeleteSharedSecretDTO) => {
     const { actor, actorId, orgId, actorAuthMethod, actorOrgId, sharedSecretId } = deleteSharedSecretInput;
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-    if (!permission) throw new UnauthorizedError({ name: "User not in org" });
+    if (!permission) throw new ForbiddenRequestError({ name: "User does not belong to the specified organization" });
     const deletedSharedSecret = await secretSharingDAL.deleteById(sharedSecretId);
     return deletedSharedSecret;
   };

backend/src/services/secret-tag/secret-tag-service.ts

@@ -47,7 +47,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
 
   const updateTag = async ({ actorId, actor, actorOrgId, actorAuthMethod, id, color, slug }: TUpdateTagDTO) => {
     const tag = await secretTagDAL.findById(id);
-    if (!tag) throw new BadRequestError({ message: "Tag doesn't exist" });
+    if (!tag) throw new NotFoundError({ message: "Tag not found" });
 
     if (slug) {
       const existingTag = await secretTagDAL.findOne({ slug, projectId: tag.projectId });
@@ -69,7 +69,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
 
   const deleteTag = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TDeleteTagDTO) => {
     const tag = await secretTagDAL.findById(id);
-    if (!tag) throw new BadRequestError({ message: "Tag doesn't exist" });
+    if (!tag) throw new NotFoundError({ message: "Tag not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -86,7 +86,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
 
   const getTagById = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TGetTagByIdDTO) => {
     const tag = await secretTagDAL.findById(id);
-    if (!tag) throw new NotFoundError({ message: "Tag doesn't exist" });
+    if (!tag) throw new NotFoundError({ message: "Tag not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -102,7 +102,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
 
   const getTagBySlug = async ({ actorId, actor, actorOrgId, actorAuthMethod, slug, projectId }: TGetTagBySlugDTO) => {
     const tag = await secretTagDAL.findOne({ projectId, slug });
-    if (!tag) throw new NotFoundError({ message: "Tag doesn't exist" });
+    if (!tag) throw new NotFoundError({ message: "Tag not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,

backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts

@@ -3,7 +3,7 @@ import { validate as uuidValidate } from "uuid";
 
 import { TDbClient } from "@app/db";
 import { SecretsV2Schema, SecretType, TableName, TSecretsV2, TSecretsV2Update } from "@app/db/schemas";
-import { BadRequestError, DatabaseError } from "@app/lib/errors";
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
 import { SecretsOrderBy } from "@app/services/secret/secret-types";
@@ -61,7 +61,7 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
       );
 
       if (existingSecrets.length !== data.length) {
-        throw new BadRequestError({ message: "Some of the secrets do not exist" });
+        throw new NotFoundError({ message: "One or more secrets was not found" });
       }
 
       if (data.length === 0) return [];

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -1,7 +1,7 @@
 import path from "node:path";
 
 import { TableName, TSecretFolders, TSecretsV2 } from "@app/db/schemas";
-import { UnauthorizedError } from "@app/lib/errors";
+import { ForbiddenRequestError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 
@@ -436,7 +436,7 @@ export const expandSecretReferencesFactory = ({
             const [secretKey] = entities;
 
             if (!canExpandValue(environment, secretPath))
-              throw new UnauthorizedError({
+              throw new ForbiddenRequestError({
                 message: `You are attempting to reference secret named ${secretKey} from environment ${environment} in path ${secretPath} which you do not have access to.`
               });
 
@@ -461,7 +461,7 @@ export const expandSecretReferencesFactory = ({
             const secretReferenceKey = entities[entities.length - 1];
 
             if (!canExpandValue(secretReferenceEnvironment, secretReferencePath))
-              throw new UnauthorizedError({
+              throw new ForbiddenRequestError({
                 message: `You are attempting to reference secret named ${secretReferenceKey} from environment ${secretReferenceEnvironment} in path ${secretReferencePath} which you do not have access to.`
               });
 

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -7,7 +7,7 @@ import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-app
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { setKnexStringValue } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
@@ -117,7 +117,7 @@ export const secretV2BridgeServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
@@ -144,7 +144,7 @@ export const secretV2BridgeServiceFactory = ({
     // validate tags
     // fetch all tags and if not same count throw error meaning one was invalid tags
     const tags = inputSecret.tagIds ? await secretTagDAL.find({ projectId, $in: { id: inputSecret.tagIds } }) : [];
-    if ((inputSecret.tagIds || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" });
+    if ((inputSecret.tagIds || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
 
     const { secretName, type, ...el } = inputSecret;
     const references = getAllNestedSecretReferences(inputSecret.secretValue);
@@ -237,7 +237,7 @@ export const secretV2BridgeServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "UpdateSecret"
       });
@@ -260,7 +260,7 @@ export const secretV2BridgeServiceFactory = ({
         folderId,
         userId: actorId
       });
-      if (!personalSecretToModify) throw new BadRequestError({ message: "Secret not found" });
+      if (!personalSecretToModify) throw new NotFoundError({ message: "Secret not found" });
       secretId = personalSecretToModify.id;
       secret = personalSecretToModify;
     } else {
@@ -269,7 +269,7 @@ export const secretV2BridgeServiceFactory = ({
         type: SecretType.Shared,
         folderId
       });
-      if (!sharedSecretToModify) throw new BadRequestError({ message: "Secret not found" });
+      if (!sharedSecretToModify) throw new NotFoundError({ message: "Secret not found" });
       secretId = sharedSecretToModify.id;
       secret = sharedSecretToModify;
     }
@@ -286,7 +286,7 @@ export const secretV2BridgeServiceFactory = ({
     // validate tags
     // fetch all tags and if not same count throw error meaning one was invalid tags
     const tags = inputSecret.tagIds ? await secretTagDAL.find({ projectId, $in: { id: inputSecret.tagIds } }) : [];
-    if ((inputSecret.tagIds || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" });
+    if ((inputSecret.tagIds || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
 
     const { secretName, secretValue } = inputSecret;
 
@@ -388,7 +388,7 @@ export const secretV2BridgeServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Delete secret"
       });
@@ -792,7 +792,7 @@ export const secretV2BridgeServiceFactory = ({
     );
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
@@ -878,7 +878,7 @@ export const secretV2BridgeServiceFactory = ({
         }
       }
     }
-    if (!secret) throw new BadRequestError({ message: "Secret not found" });
+    if (!secret) throw new NotFoundError({ message: "Secret not found" });
 
     let secretValue = secret.encryptedValue
       ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString()
@@ -927,7 +927,7 @@ export const secretV2BridgeServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
@@ -946,7 +946,7 @@ export const secretV2BridgeServiceFactory = ({
     // get all tags
     const sanitizedTagIds = inputSecrets.flatMap(({ tagIds = [] }) => tagIds);
     const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : [];
-    if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" });
+    if (tags.length !== sanitizedTagIds.length) throw new NotFoundError({ message: "Tag not found" });
 
     const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
       await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId });
@@ -1032,7 +1032,7 @@ export const secretV2BridgeServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Update secret"
       });
@@ -1046,7 +1046,7 @@ export const secretV2BridgeServiceFactory = ({
       }))
     );
     if (secretsToUpdate.length !== inputSecrets.length)
-      throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` });
+      throw new NotFoundError({ message: `Secret does not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` });
     const secretsToUpdateInDBGroupedByKey = groupBy(secretsToUpdate, (i) => i.key);
 
     // now find any secret that needs to update its name
@@ -1062,14 +1062,14 @@ export const secretV2BridgeServiceFactory = ({
       );
       if (secrets.length)
         throw new BadRequestError({
-          message: `Secret with new name exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}`
+          message: `Secret with new name already exists: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}`
         });
     }
 
     // get all tags
     const sanitizedTagIds = inputSecrets.flatMap(({ tagIds = [] }) => tagIds);
     const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : [];
-    if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" });
+    if (tags.length !== sanitizedTagIds.length) throw new NotFoundError({ message: "Tag not found" });
 
     const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
       await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId });
@@ -1164,7 +1164,7 @@ export const secretV2BridgeServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
@@ -1178,7 +1178,9 @@ export const secretV2BridgeServiceFactory = ({
       }))
     );
     if (secretsToDelete.length !== inputSecrets.length)
-      throw new BadRequestError({ message: `Secret not exist: ${secretsToDelete.map((el) => el.key).join(",")}` });
+      throw new NotFoundError({
+        message: `One or more secrets does not exist: ${secretsToDelete.map((el) => el.key).join(",")}`
+      });
 
     const secretsDeleted = await secretDAL.transaction(async (tx) =>
       fnSecretBulkDelete({
@@ -1227,10 +1229,10 @@ export const secretV2BridgeServiceFactory = ({
     secretId
   }: TGetSecretVersionsDTO) => {
     const secret = await secretDAL.findById(secretId);
-    if (!secret) throw new BadRequestError({ message: "Failed to find secret" });
+    if (!secret) throw new NotFoundError({ message: "Failed to find secret" });
 
     const folder = await folderDAL.findById(secret.folderId);
-    if (!folder) throw new BadRequestError({ message: "Failed to find secret" });
+    if (!folder) throw new NotFoundError({ message: "Failed to find secret" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -1273,7 +1275,7 @@ export const secretV2BridgeServiceFactory = ({
     );
 
     if (!hasRole(ProjectMembershipRole.Admin))
-      throw new BadRequestError({ message: "Only admins are allowed to take this action" });
+      throw new ForbiddenRequestError({ message: "Only admins are allowed to take this action" });
 
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.SecretManager,

backend/src/services/secret/secret-dal.ts

@@ -3,7 +3,7 @@ import { validate as uuidValidate } from "uuid";
 
 import { TDbClient } from "@app/db";
 import { SecretsSchema, SecretType, TableName, TSecrets, TSecretsUpdate } from "@app/db/schemas";
-import { BadRequestError, DatabaseError } from "@app/lib/errors";
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
 export type TSecretDALFactory = ReturnType<typeof secretDALFactory>;
@@ -55,7 +55,7 @@ export const secretDALFactory = (db: TDbClient) => {
       );
 
       if (existingSecrets.length !== data.length) {
-        throw new BadRequestError({ message: "Some of the secrets do not exist" });
+        throw new NotFoundError({ message: "Some of the secrets do not exist" });
       }
 
       if (data.length === 0) return [];

backend/src/services/secret/secret-fns.ts

@@ -19,7 +19,7 @@ import {
   decryptSymmetric128BitHexKeyUTF8,
   encryptSymmetric128BitHexKeyUTF8
 } from "@app/lib/crypto";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy, unique } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import {
@@ -498,7 +498,7 @@ export const fnSecretBlindIndexCheck = async ({
     const hasUnknownSecretsProvided = secretKeysInDB.length !== inputSecrets.length;
     if (hasUnknownSecretsProvided) {
       const keysMissingInDB = Object.keys(keyName2BlindIndex).filter((key) => !secretKeysInDB.includes(key));
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: `Secret not found: blind index ${keysMissingInDB.join(",")}`
       });
     }
@@ -757,7 +757,7 @@ export const createManySecretsRawFnFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
@@ -798,7 +798,7 @@ export const createManySecretsRawFnFactory = ({
       // get all tags
       const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags);
       const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-      if (tags.length !== tagIds.length) throw new BadRequestError({ message: "Tag not found" });
+      if (tags.length !== tagIds.length) throw new NotFoundError({ message: "Tag not found" });
 
       const newSecrets = await secretDAL.transaction(async (tx) =>
         fnSecretV2BridgeBulkInsert({
@@ -820,7 +820,7 @@ export const createManySecretsRawFnFactory = ({
     }
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Create secret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Create secret" });
 
     // insert operation
     const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({
@@ -833,7 +833,7 @@ export const createManySecretsRawFnFactory = ({
     });
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -865,7 +865,7 @@ export const createManySecretsRawFnFactory = ({
     // get all tags
     const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags);
     const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-    if (tags.length !== tagIds.length) throw new BadRequestError({ message: "Tag not found" });
+    if (tags.length !== tagIds.length) throw new NotFoundError({ message: "Tag not found" });
 
     const newSecrets = await secretDAL.transaction(async (tx) =>
       fnSecretBulkInsert({
@@ -917,7 +917,7 @@ export const updateManySecretsRawFnFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Update secret"
       });
@@ -936,7 +936,7 @@ export const updateManySecretsRawFnFactory = ({
         }))
       );
       if (secretsToUpdate.length !== secrets.length)
-        throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` });
+        throw new NotFoundError({ message: `Secret does not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` });
 
       // now find any secret that needs to update its name
       // same process as above
@@ -950,8 +950,8 @@ export const updateManySecretsRawFnFactory = ({
           }))
         );
         if (secretsWithNewNameInDB.length)
-          throw new BadRequestError({
-            message: `Secret not exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}`
+          throw new NotFoundError({
+            message: `Secret does not exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}`
           });
       }
 
@@ -977,7 +977,7 @@ export const updateManySecretsRawFnFactory = ({
 
       const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags);
       const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-      if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" });
+      if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
 
       const updatedSecrets = await secretDAL.transaction(async (tx) =>
         fnSecretV2BridgeBulkUpdate({
@@ -998,12 +998,12 @@ export const updateManySecretsRawFnFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Update secret" });
 
     const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({
       inputSecrets: secrets,
@@ -1046,7 +1046,7 @@ export const updateManySecretsRawFnFactory = ({
 
     const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags);
     const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-    if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" });
+    if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
 
     // now find any secret that needs to update its name
     // same process as above

backend/src/services/secret/secret-queue.ts

@@ -18,7 +18,7 @@ import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/
 import { getConfig } from "@app/lib/config/env";
 import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto";
 import { daysToMillisecond, secondsToMillis } from "@app/lib/dates";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { getTimeDifferenceInSeconds, groupBy, isSamePath, unique } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
@@ -1033,7 +1033,7 @@ export const secretQueueFactory = ({
     if (isProjectUpgradedToV3 || project.upgradeStatus === ProjectUpgradeStatus.InProgress) {
       return;
     }
-    if (!botKey) throw new BadRequestError({ message: "Bot not found" });
+    if (!botKey) throw new NotFoundError({ message: "Project bot not found" });
     await projectDAL.updateById(projectId, { upgradeStatus: ProjectUpgradeStatus.InProgress });
 
     const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({

backend/src/services/secret/secret-service.ts

@@ -23,7 +23,7 @@ import {
   decryptSymmetric128BitHexKeyUTF8,
   encryptSymmetric128BitHexKeyUTF8
 } from "@app/lib/crypto";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy, pick } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -153,7 +153,7 @@ export const secretServiceFactory = ({
     const appCfg = getConfig();
 
     const secretBlindIndexDoc = await secretBlindIndexDAL.findOne({ projectId });
-    if (!secretBlindIndexDoc) throw new BadRequestError({ message: "Blind index not found", name: "Create secret" });
+    if (!secretBlindIndexDoc) throw new NotFoundError({ message: "Blind index not found", name: "Create secret" });
 
     const secretBlindIndex = await buildSecretBlindIndexFromName({
       secretName,
@@ -164,7 +164,7 @@ export const secretServiceFactory = ({
       ciphertext: secretBlindIndexDoc.encryptedSaltCipherText,
       iv: secretBlindIndexDoc.saltIV
     });
-    if (!secretBlindIndex) throw new BadRequestError({ message: "Secret not found" });
+    if (!secretBlindIndex) throw new NotFoundError({ message: "Secret not found" });
     return secretBlindIndex;
   };
 
@@ -194,14 +194,14 @@ export const secretServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
     const folderId = folder.id;
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" });
 
     if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) {
       throw new BadRequestError({ message: "Must be user to create personal secret" });
@@ -232,7 +232,7 @@ export const secretServiceFactory = ({
     // validate tags
     // fetch all tags and if not same count throw error meaning one was invalid tags
     const tags = inputSecret.tags ? await secretTagDAL.findManyTagsById(projectId, inputSecret.tags) : [];
-    if ((inputSecret.tags || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" });
+    if ((inputSecret.tags || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
 
     const { secretName, type, ...el } = inputSecret;
     const references = await getSecretReference(projectId);
@@ -305,14 +305,14 @@ export const secretServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
     const folderId = folder.id;
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" });
 
     if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) {
       throw new BadRequestError({ message: "Must be user to create personal secret" });
@@ -352,7 +352,7 @@ export const secretServiceFactory = ({
     });
 
     const tags = inputSecret.tags ? await secretTagDAL.findManyTagsById(projectId, inputSecret.tags) : [];
-    if ((inputSecret.tags || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" });
+    if ((inputSecret.tags || []).length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
 
     const { secretName, ...el } = inputSecret;
 
@@ -436,14 +436,14 @@ export const secretServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
     const folderId = folder.id;
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "CreateSecret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "CreateSecret" });
 
     if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) {
       throw new BadRequestError({ message: "Must be user to create personal secret" });
@@ -617,7 +617,7 @@ export const secretServiceFactory = ({
     );
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
@@ -688,7 +688,7 @@ export const secretServiceFactory = ({
         }
       }
     }
-    if (!secret) throw new BadRequestError({ message: "Secret not found" });
+    if (!secret) throw new NotFoundError({ message: "Secret not found" });
 
     return { ...secret, workspace: projectId, environment, secretPath: path };
   };
@@ -719,14 +719,14 @@ export const secretServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
     const folderId = folder.id;
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Create secret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Create secret" });
 
     const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({
       inputSecrets,
@@ -739,7 +739,7 @@ export const secretServiceFactory = ({
     // get all tags
     const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags);
     const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-    if (tags.length !== tagIds.length) throw new BadRequestError({ message: "Tag not found" });
+    if (tags.length !== tagIds.length) throw new NotFoundError({ message: "Tag not found" });
 
     const references = await getSecretReference(projectId);
     const newSecrets = await secretDAL.transaction(async (tx) =>
@@ -804,14 +804,14 @@ export const secretServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Update secret"
       });
     const folderId = folder.id;
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Update secret" });
 
     const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({
       inputSecrets,
@@ -835,7 +835,7 @@ export const secretServiceFactory = ({
     // get all tags
     const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags);
     const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-    if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" });
+    if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
 
     const references = await getSecretReference(projectId);
     const secrets = await secretDAL.transaction(async (tx) =>
@@ -910,14 +910,14 @@ export const secretServiceFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Folder not found for the given environment slug & secret path",
         name: "Create secret"
       });
     const folderId = folder.id;
 
     const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId });
-    if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" });
+    if (!blindIndexCfg) throw new NotFoundError({ message: "Blind index not found", name: "Update secret" });
 
     const { keyName2BlindIndex } = await fnSecretBlindIndexCheck({
       inputSecrets,
@@ -981,7 +981,7 @@ export const secretServiceFactory = ({
     if (!shouldUseSecretV2Bridge)
       throw new BadRequestError({
         message: "Project version does not support pagination",
-        name: "pagination_not_supported"
+        name: "PaginationNotSupportedError"
       });
 
     const count = await secretV2BridgeService.getSecretsCount({
@@ -1017,7 +1017,7 @@ export const secretServiceFactory = ({
     if (!shouldUseSecretV2Bridge)
       throw new BadRequestError({
         message: "Project version does not support pagination",
-        name: "pagination_not_supported"
+        name: "PaginationNotSupportedError"
       });
 
     const count = await secretV2BridgeService.getSecretsCountMultiEnv({
@@ -1052,7 +1052,7 @@ export const secretServiceFactory = ({
     if (!shouldUseSecretV2Bridge)
       throw new BadRequestError({
         message: "Project version does not support pagination",
-        name: "pagination_not_supported"
+        name: "PaginationNotSupportError"
       });
 
     const secrets = await secretV2BridgeService.getSecretsMultiEnv({
@@ -1103,7 +1103,7 @@ export const secretServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -1267,7 +1267,7 @@ export const secretServiceFactory = ({
     });
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -1363,7 +1363,7 @@ export const secretServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -1505,7 +1505,7 @@ export const secretServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -1631,7 +1631,7 @@ export const secretServiceFactory = ({
       return { type: SecretProtectionType.Direct as const, secret };
     }
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -1688,7 +1688,7 @@ export const secretServiceFactory = ({
     // pick either project slug or projectid
     if (!optionalProjectId && projectSlug) {
       const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-      if (!project) throw new BadRequestError({ message: "Project not found" });
+      if (!project) throw new NotFoundError({ message: "Project not found" });
       projectId = project.id;
     }
 
@@ -1735,7 +1735,7 @@ export const secretServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -1815,7 +1815,7 @@ export const secretServiceFactory = ({
     let projectId = optionalProjectId as string;
     if (!optionalProjectId && projectSlug) {
       const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-      if (!project) throw new BadRequestError({ message: "Project not found" });
+      if (!project) throw new NotFoundError({ message: "Project not found" });
       projectId = project.id;
     }
 
@@ -1861,7 +1861,7 @@ export const secretServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -1953,7 +1953,7 @@ export const secretServiceFactory = ({
     let projectId = optionalProjectId as string;
     if (!optionalProjectId && projectSlug) {
       const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-      if (!project) throw new BadRequestError({ message: "Project not found" });
+      if (!project) throw new NotFoundError({ message: "Project not found" });
       projectId = project.id;
     }
 
@@ -1993,7 +1993,7 @@ export const secretServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -2060,12 +2060,12 @@ export const secretServiceFactory = ({
     if (secretVersionV2) return secretVersionV2;
 
     const secret = await secretDAL.findById(secretId);
-    if (!secret) throw new BadRequestError({ message: "Failed to find secret" });
+    if (!secret) throw new NotFoundError({ message: "Failed to find secret" });
     const folder = await folderDAL.findById(secret.folderId);
-    if (!folder) throw new BadRequestError({ message: "Failed to find secret" });
+    if (!folder) throw new NotFoundError({ message: "Failed to find secret" });
 
     const { botKey } = await projectBotService.getBotKey(folder.projectId);
-    if (!botKey) throw new BadRequestError({ message: "bot not found" });
+    if (!botKey) throw new NotFoundError({ message: "Project bot not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -2130,12 +2130,12 @@ export const secretServiceFactory = ({
     });
 
     if (!secret) {
-      throw new BadRequestError({ message: "Secret not found" });
+      throw new NotFoundError({ message: "Secret not found" });
     }
     const folder = await folderDAL.findBySecretPath(project.id, environment, secretPath);
 
     if (!folder) {
-      throw new BadRequestError({ message: "Folder not found" });
+      throw new NotFoundError({ message: "Folder not found" });
     }
 
     const tags = await secretTagDAL.find({
@@ -2146,7 +2146,7 @@ export const secretServiceFactory = ({
     });
 
     if (tags.length !== tagSlugs.length) {
-      throw new BadRequestError({ message: "One or more tags not found." });
+      throw new NotFoundError({ message: "One or more tags not found." });
     }
 
     const existingSecretTags = await secretDAL.getSecretTags(secret.id);
@@ -2232,12 +2232,12 @@ export const secretServiceFactory = ({
     });
 
     if (!secret) {
-      throw new BadRequestError({ message: "Secret not found" });
+      throw new NotFoundError({ message: "Secret not found" });
     }
     const folder = await folderDAL.findBySecretPath(project.id, environment, secretPath);
 
     if (!folder) {
-      throw new BadRequestError({ message: "Folder not found" });
+      throw new NotFoundError({ message: "Folder not found" });
     }
 
     const tags = await secretTagDAL.find({
@@ -2248,7 +2248,7 @@ export const secretServiceFactory = ({
     });
 
     if (tags.length !== tagSlugs.length) {
-      throw new BadRequestError({ message: "One or more tags not found." });
+      throw new NotFoundError({ message: "One or more tags not found." });
     }
 
     const existingSecretTags = await secretDAL.getSecretTags(secret.id);
@@ -2258,7 +2258,7 @@ export const secretServiceFactory = ({
     const secretTagIds = existingSecretTags.map((tag) => tag.id);
 
     if (!tagIdsToRemove.every((el) => secretTagIds.includes(el))) {
-      throw new BadRequestError({ message: "One or more tags not found on the secret" });
+      throw new NotFoundError({ message: "One or more tags not found on the secret" });
     }
 
     const newTags = existingSecretTags.filter((tag) => !tagIdsToRemove.includes(tag.id));
@@ -2316,7 +2316,7 @@ export const secretServiceFactory = ({
     );
 
     if (!hasRole(ProjectMembershipRole.Admin))
-      throw new BadRequestError({ message: "Only admins are allowed to take this action" });
+      throw new ForbiddenRequestError({ message: "Only admins are allowed to take this action" });
 
     const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
     if (shouldUseSecretV2Bridge) {
@@ -2330,7 +2330,7 @@ export const secretServiceFactory = ({
     }
 
     if (!botKey)
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -2416,7 +2416,7 @@ export const secretServiceFactory = ({
 
     const { botKey } = await projectBotService.getBotKey(project.id);
     if (!botKey) {
-      throw new BadRequestError({
+      throw new NotFoundError({
         message: "Project bot not found. Please upgrade your project.",
         name: "bot_not_found_error"
       });
@@ -2777,12 +2777,12 @@ export const secretServiceFactory = ({
     );
 
     if (!hasRole(ProjectMembershipRole.Admin))
-      throw new BadRequestError({ message: "Only admins are allowed to take this action" });
+      throw new ForbiddenRequestError({ message: "Only admins are allowed to take this action" });
 
     const { shouldUseSecretV2Bridge: isProjectV3, project } = await projectBotService.getBotKey(projectId);
-    if (isProjectV3) throw new BadRequestError({ message: "project is already in v3" });
+    if (isProjectV3) throw new BadRequestError({ message: "Project is already V3" });
     if (project.upgradeStatus === ProjectUpgradeStatus.InProgress)
-      throw new BadRequestError({ message: "project is upgrading" });
+      throw new BadRequestError({ message: "Project is already being upgraded" });
 
     await secretQueueService.startSecretV2Migration(projectId);
     return { message: "Migrating project to new KMS architecture" };

backend/src/services/secret/secret-version-dal.ts

@@ -2,7 +2,7 @@ import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
 import { TableName, TSecretVersions, TSecretVersionsUpdate } from "@app/db/schemas";
-import { BadRequestError, DatabaseError } from "@app/lib/errors";
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
 import { QueueName } from "@app/queue";
@@ -72,7 +72,7 @@ export const secretVersionDALFactory = (db: TDbClient) => {
       );
 
       if (existingSecretVersions.length !== data.length) {
-        throw new BadRequestError({ message: "Some of the secret versions do not exist" });
+        throw new NotFoundError({ message: "Some of the secret versions do not exist" });
       }
 
       if (data.length === 0) return [];

backend/src/services/service-token/service-token-service.ts

@@ -6,7 +6,7 @@ import bcrypt from "bcrypt";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 
 import { TAccessTokenQueueServiceFactory } from "../access-token-queue/access-token-queue";
 import { ActorType } from "../auth/auth-type";
@@ -75,7 +75,7 @@ export const serviceTokenServiceFactory = ({
     // validates env
     const scopeEnvs = [...new Set(scopes.map(({ environment }) => environment))];
     const inputEnvs = await projectEnvDAL.findBySlugs(projectId, scopeEnvs);
-    if (inputEnvs.length !== scopeEnvs.length) throw new BadRequestError({ message: "Environment not found" });
+    if (inputEnvs.length !== scopeEnvs.length) throw new NotFoundError({ message: "Environment not found" });
 
     const secret = crypto.randomBytes(16).toString("hex");
     const secretHash = await bcrypt.hash(secret, appCfg.SALT_ROUNDS);
@@ -106,7 +106,7 @@ export const serviceTokenServiceFactory = ({
 
   const deleteServiceToken = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TDeleteServiceTokenDTO) => {
     const serviceToken = await serviceTokenDAL.findById(id);
-    if (!serviceToken) throw new BadRequestError({ message: "Token not found" });
+    if (!serviceToken) throw new NotFoundError({ message: "Token not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -122,13 +122,13 @@ export const serviceTokenServiceFactory = ({
   };
 
   const getServiceToken = async ({ actor, actorId }: TGetServiceTokenInfoDTO) => {
-    if (actor !== ActorType.SERVICE) throw new BadRequestError({ message: "Service token not found" });
+    if (actor !== ActorType.SERVICE) throw new NotFoundError({ message: "Service token not found" });
 
     const serviceToken = await serviceTokenDAL.findById(actorId);
-    if (!serviceToken) throw new BadRequestError({ message: "Token not found" });
+    if (!serviceToken) throw new NotFoundError({ message: "Token not found" });
 
     const serviceTokenUser = await userDAL.findById(serviceToken.createdBy);
-    if (!serviceTokenUser) throw new BadRequestError({ message: "Service token user not found" });
+    if (!serviceTokenUser) throw new NotFoundError({ message: "Service token user not found" });
 
     return { serviceToken, user: serviceTokenUser };
   };
@@ -154,21 +154,21 @@ export const serviceTokenServiceFactory = ({
   };
 
   const fnValidateServiceToken = async (token: string) => {
-    const [, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>token.split(".", 3);
-    const serviceToken = await serviceTokenDAL.findById(TOKEN_IDENTIFIER);
+    const [, tokenIdentifier, tokenSecret] = <[string, string, string]>token.split(".", 3);
+    const serviceToken = await serviceTokenDAL.findById(tokenIdentifier);
 
-    if (!serviceToken) throw new UnauthorizedError();
+    if (!serviceToken) throw new NotFoundError({ message: "Service token not found" });
     const project = await projectDAL.findById(serviceToken.projectId);
 
-    if (!project) throw new UnauthorizedError({ message: "Service token project not found" });
+    if (!project) throw new NotFoundError({ message: "Service token project not found" });
 
     if (serviceToken.expiresAt && new Date(serviceToken.expiresAt) < new Date()) {
       await serviceTokenDAL.deleteById(serviceToken.id);
-      throw new UnauthorizedError({ message: "failed to authenticate expired service token" });
+      throw new ForbiddenRequestError({ message: "Service token has expired" });
     }
 
-    const isMatch = await bcrypt.compare(TOKEN_SECRET, serviceToken.secretHash);
-    if (!isMatch) throw new UnauthorizedError();
+    const isMatch = await bcrypt.compare(tokenSecret, serviceToken.secretHash);
+    if (!isMatch) throw new UnauthorizedError({ message: "Invalid service token" });
     await accessTokenQueue.updateServiceTokenStatus(serviceToken.id);
 
     return { ...serviceToken, lastUsed: new Date(), orgId: project.orgId };

backend/src/services/super-admin/super-admin-service.ts

@@ -54,7 +54,7 @@ export const superAdminServiceFactory = ({
         const serverCfg = await serverCfgDAL.findById(ADMIN_CONFIG_DB_UUID);
 
         if (!serverCfg) {
-          throw new BadRequestError({ name: "Admin config", message: "Admin config not found" });
+          throw new NotFoundError({ message: "Admin config not found" });
         }
 
         await keyStore.setItemWithExpiry(ADMIN_CONFIG_KEY, ADMIN_CONFIG_KEY_EXP, JSON.stringify(serverCfg)); // insert it back to keystore
@@ -167,7 +167,7 @@ export const superAdminServiceFactory = ({
   }: TAdminSignUpDTO) => {
     const appCfg = getConfig();
     const existingUser = await userDAL.findOne({ email });
-    if (existingUser) throw new BadRequestError({ name: "Admin sign up", message: "User already exist" });
+    if (existingUser) throw new BadRequestError({ name: "Admin sign up", message: "User already exists" });
 
     const privateKey = await getUserPrivateKey(password, {
       encryptionVersion: 2,

backend/src/services/user/user-service.ts

@@ -4,7 +4,7 @@ import { SecretKeyEncoding } from "@app/db/schemas";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TokenType } from "@app/services/auth-token/auth-token-types";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
@@ -55,7 +55,7 @@ export const userServiceFactory = ({
 }: TUserServiceFactoryDep) => {
   const sendEmailVerificationCode = async (username: string) => {
     const user = await userDAL.findOne({ username });
-    if (!user) throw new BadRequestError({ name: "Failed to find user" });
+    if (!user) throw new NotFoundError({ name: "Failed to find user" });
     if (!user.email)
       throw new BadRequestError({ name: "Failed to send email verification code due to no email on user" });
     if (user.isEmailVerified)
@@ -78,7 +78,7 @@ export const userServiceFactory = ({
 
   const verifyEmailVerificationCode = async (username: string, code: string) => {
     const user = await userDAL.findOne({ username });
-    if (!user) throw new BadRequestError({ name: "Failed to find user" });
+    if (!user) throw new NotFoundError({ name: "Failed to find user" });
     if (!user.email)
       throw new BadRequestError({ name: "Failed to verify email verification code due to no email on user" });
     if (user.isEmailVerified)
@@ -113,7 +113,7 @@ export const userServiceFactory = ({
       if (users.length > 1) {
         // merge users
         const mergeUser = users.find((u) => u.id !== user.id);
-        if (!mergeUser) throw new BadRequestError({ name: "Failed to find merge user" });
+        if (!mergeUser) throw new NotFoundError({ name: "Failed to find merge user" });
 
         const mergeUserOrgMembershipSet = new Set(
           (await orgMembershipDAL.find({ userId: mergeUser.id }, { tx })).map((m) => m.orgId)
@@ -193,13 +193,11 @@ export const userServiceFactory = ({
 
   const updateAuthMethods = async (userId: string, authMethods: AuthMethod[]) => {
     const user = await userDAL.findById(userId);
-    if (!user) throw new BadRequestError({ name: "Update auth methods" });
+    if (!user) throw new NotFoundError({ message: "User not found" });
 
-    if (user.authMethods?.includes(AuthMethod.LDAP))
-      throw new BadRequestError({ message: "LDAP auth method cannot be updated", name: "Update auth methods" });
-
-    if (authMethods.includes(AuthMethod.LDAP))
+    if (user.authMethods?.includes(AuthMethod.LDAP) || authMethods.includes(AuthMethod.LDAP)) {
       throw new BadRequestError({ message: "LDAP auth method cannot be updated", name: "Update auth methods" });
+    }
 
     const updatedUser = await userDAL.updateById(userId, { authMethods });
     return updatedUser;
@@ -207,7 +205,7 @@ export const userServiceFactory = ({
 
   const getMe = async (userId: string) => {
     const user = await userDAL.findUserEncKeyByUserId(userId);
-    if (!user) throw new BadRequestError({ message: "user not found", name: "Get Me" });
+    if (!user) throw new NotFoundError({ message: "User not found" });
     return user;
   };
 
@@ -248,7 +246,7 @@ export const userServiceFactory = ({
   const getUserPrivateKey = async (userId: string) => {
     const user = await userDAL.findUserEncKeyByUserId(userId);
     if (!user?.serverEncryptedPrivateKey || !user.serverEncryptedPrivateKeyIV || !user.serverEncryptedPrivateKeyTag) {
-      throw new BadRequestError({ message: "Private key not found. Please login again" });
+      throw new NotFoundError({ message: "Private key not found. Please login again" });
     }
     const privateKey = infisicalSymmetricDecrypt({
       ciphertext: user.serverEncryptedPrivateKey,
@@ -267,7 +265,7 @@ export const userServiceFactory = ({
     });
 
     if (!orgMembership) {
-      throw new BadRequestError({
+      throw new ForbiddenRequestError({
         message: "User does not belong in the organization."
       });
     }
@@ -282,7 +280,7 @@ export const userServiceFactory = ({
     });
 
     if (!orgMembership) {
-      throw new BadRequestError({
+      throw new ForbiddenRequestError({
         message: "User does not belong in the organization."
       });
     }

backend/src/services/webhook/webhook-fns.ts

@@ -6,7 +6,7 @@ import picomatch from "picomatch";
 import { SecretKeyEncoding, TWebhooks } from "@app/db/schemas";
 import { request } from "@app/lib/config/request";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 
 import { TProjectDALFactory } from "../project/project-dal";
@@ -172,7 +172,7 @@ export const fnTriggerWebhook = async ({
 
   await webhookDAL.transaction(async (tx) => {
     const env = await projectEnvDAL.findOne({ projectId, slug: environment }, tx);
-    if (!env) throw new BadRequestError({ message: "Env not found" });
+    if (!env) throw new NotFoundError({ message: "Environment not found" });
     if (successWebhooks.length) {
       await webhookDAL.update(
         { envId: env.id, $in: { id: successWebhooks } },

backend/src/services/webhook/webhook-service.ts

@@ -4,7 +4,7 @@ import { TWebhooksInsert } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
@@ -54,7 +54,7 @@ export const webhookServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Webhooks);
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
-    if (!env) throw new BadRequestError({ message: "Env not found" });
+    if (!env) throw new NotFoundError({ message: "Environment not found" });
 
     const insertDoc: TWebhooksInsert = {
       url: "", // deprecated - we are moving away from plaintext URLs
@@ -88,7 +88,7 @@ export const webhookServiceFactory = ({
 
   const updateWebhook = async ({ actorId, actor, actorOrgId, actorAuthMethod, id, isDisabled }: TUpdateWebhookDTO) => {
     const webhook = await webhookDAL.findById(id);
-    if (!webhook) throw new BadRequestError({ message: "Webhook not found" });
+    if (!webhook) throw new NotFoundError({ message: "Webhook not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -105,7 +105,7 @@ export const webhookServiceFactory = ({
 
   const deleteWebhook = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TDeleteWebhookDTO) => {
     const webhook = await webhookDAL.findById(id);
-    if (!webhook) throw new BadRequestError({ message: "Webhook not found" });
+    if (!webhook) throw new NotFoundError({ message: "Webhook not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -122,7 +122,7 @@ export const webhookServiceFactory = ({
 
   const testWebhook = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TTestWebhookDTO) => {
     const webhook = await webhookDAL.findById(id);
-    if (!webhook) throw new BadRequestError({ message: "Webhook not found" });
+    if (!webhook) throw new NotFoundError({ message: "Webhook not found" });
 
     const { permission } = await permissionService.getProjectPermission(
       actor,