synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-03 16:13:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Rbac errors should be returned, and not hidden behind 404 (#7122)

Browse Source 
* chore: Rbac errors should be returned, and not hidden behind 404

SqlErrNoRows was hiding actual errors
* Replace sql.ErrNoRow checks
* Remove sql err no rows check from dbauthz test
* Fix to use dbauthz system user
This commit is contained in:
Steven Masley
2023-04-13 13:06:16 -05:00
committed by GitHub
parent fa64c58e56
commit 38e5b9679b
23 changed files with 50 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
coderd/httpapi/httpapi.go
View File

@ -3,6 +3,7 @@ package httpapi
import (
"bytes"
"context"
"database/sql"
"encoding/json"
"errors"
"flag"
@ -15,6 +16,8 @@ import (
"github.com/go-playground/validator/v10"
"golang.org/x/xerrors"
"github.com/coder/coder/coderd/database/dbauthz"
"github.com/coder/coder/coderd/rbac"
"github.com/coder/coder/coderd/tracing"
"github.com/coder/coder/codersdk"
)
@ -80,6 +83,16 @@ func init() {
}
}
// Is404Error returns true if the given error should return a 404 status code.
// Both actual 404s and unauthorized errors should return 404s to not leak
// information about the existence of resources.
func Is404Error(err error) bool {
if err == nil {
return false
}
return xerrors.Is(err, sql.ErrNoRows) || dbauthz.IsNotAuthorizedError(err) || rbac.IsUnauthorizedError(err)
}
// Convenience error functions don't take contexts since their responses are
// static, it doesn't make much sense to trace them.