Repository navigation
feat(auth): tell a refused bearer, a refused account and an outage apart - #1922
Merged
Merged
Conversation
The proxy now decides the Bearer header on the public routes that read a session (GET /api/auth/me, POST /api/auth/logout, POST /api/db/health), so an unreachable identity provider answers 503 there and an expired token on logout answers 401 with the challenge. A verified token whose account has no role or no usable username answers 403 BEARER_NO_ROLE or BEARER_NO_IDENTITY, so a client stops refreshing. GET /api/connections/managed strips every secret field from an editable seed for a bearer session and exposes a governed record's grant level as access. Admin-only 403s carry ADMIN_REQUIRED through one helper, TRANSACTION_NOT_OWNED joins ApiErrorCode, and /api/admin/audit answers 401 without a session.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…does Where the runner compiled ssh2's optional sshcrypto.node, bun emits it as an asset beside the bundle and --outfile exits 1 with 'cannot write multiple output files without an output directory'. Red on main since 3e92cc6.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1914: the answers a native client on the bearer channel needs to tell a refused token, a refused account and an outage apart, and two gaps it hit in the connection list.
GET /api/auth/me,POST /api/auth/logoutandPOST /api/db/healthare on the public list but read the session, so a provider outage there read as 401 and an expired token on logout as{success:true}. The proxy now decides the Bearer header on those three as on every other API route (401 with the challenge, 503IDENTITY_PROVIDER_UNAVAILABLE). The sign-in routes and the liveness GET still never read it.BEARER_NO_ROLE/BEARER_NO_IDENTITYinstead of 401, so a client stops refreshing.GET /api/connections/managedstrips secret fields from an editable seed for a bearer session; the web cookie session keeps today's behaviour.access: "read" | "write".ADMIN_REQUIREDon every admin-only 403 through one helper,TRANSACTION_NOT_OWNEDadded toApiErrorCode, and/api/admin/auditanswers 401AUTH_REQUIREDwithout a session instead of 403.Not changed:
getSession()keeps its no-throw contract, so routes behind the proxy are untouched. A nativePOSTwithoutOriginmust sendContent-Type: application/jsonto pass the cross-site check; now documented.Also fixed here: the NETCONF live check's Node bundle now builds with
--outdir, as the OPC UA step does. Where the runner compiles ssh2's optionalsshcrypto.node, bun emits it as an asset and--outfilefailed; Functional Smoke has been red on main since 3e92cc6 for this.Tests: proxy, admin, managed list and error-code tests extended first; full suite with 100% line coverage, build,
build:lib,attwand the drift guards pass locally.