Added more information when permission is denied

Author: sbuliarca

backend/acl/config.go

@@ -16,11 +16,6 @@ import (
 	"gopkg.in/yaml.v2"
 )
 
-var (
-	// ErrUnauthorized indicates that a client doesn't have access to a resource
-	ErrUnauthorized = status.Errorf(codes.PermissionDenied, "unauthorised")
-)
-
 // Config allows retrieve of access scope for the current client
 type Config interface {
 	GetClientScope(ctx context.Context) (*Scope, error)
@@ -103,29 +98,29 @@ func (s *config) GetClientScope(ctx context.Context) (*Scope, error) {
 
 	basicAuth, err := grpc_auth.AuthFromMD(ctx, "Bearer")
 	if err != nil {
-		return nil, ErrUnauthorized
+		return nil, status.Errorf(codes.PermissionDenied, "failed getting Bearrer auth, %v", err)
 	}
 
 	payload, err := base64.StdEncoding.DecodeString(basicAuth)
 	if err != nil {
-		return nil, ErrUnauthorized
+		return nil, status.Errorf(codes.PermissionDenied, "failed getting payload: %v", err)
 	}
 
 	pair := strings.SplitN(string(payload), ":", 2)
 
 	if len(pair) != 2 {
-		return nil, ErrUnauthorized
+		return nil, status.Errorf(codes.PermissionDenied, "malformed payload: should contain 2 pairs, but got %d", len(pair))
 	}
 
 	id, secret := pair[0], pair[1]
 
 	hashPass, ok := s.auth[id]
 	if !ok {
-		return nil, ErrUnauthorized
+		return nil, status.Errorf(codes.PermissionDenied, "no password configured for id %v", id)
 	}
 
 	if err := bcrypt.CompareHashAndPassword(hashPass, []byte(secret)); err != nil {
-		return nil, ErrUnauthorized
+		return nil, status.Errorf(codes.PermissionDenied, "passwords do not match for id %v", id)
 	}
 
 	return s.scopes[id], nil

backend/acl/config_test.go

@@ -7,7 +7,9 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
 )
 
 var (
@@ -85,7 +87,14 @@ clients:
 	ctx := createCtx("dog-consumer", "123")
 	_, err = c.GetClientScope(ctx)
 
-	assert.Equal(err, ErrUnauthorized)
+	assertPermissionDenied(t, err, "passwords do not match")
+}
+
+func assertPermissionDenied(t *testing.T, err error, expString string) {
+	s, ok := status.FromError(err)
+	require.True(t, ok)
+	require.Equal(t, codes.PermissionDenied, s.Code())
+	require.ErrorContains(t, err, expString)
 }
 
 func Test_ClientWithNoAuthHasDefaultAccess(t *testing.T) {

backend/acl/sink.go

@@ -6,6 +6,8 @@ import (
 	"github.com/uw-labs/proximo"
 	"github.com/uw-labs/proximo/proto"
 	"github.com/uw-labs/substrate"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 type AsyncSinkFactory struct {
@@ -20,7 +22,7 @@ func (s AsyncSinkFactory) NewAsyncSink(ctx context.Context, req *proto.StartPubl
 	}
 
 	if !containsRegex(scope.Publish, req.Topic) {
-		return nil, ErrUnauthorized
+		return nil, status.Errorf(codes.PermissionDenied, "no publish permissions for topic %v", req.Topic)
 	}
 
 	return s.Next.NewAsyncSink(ctx, req)

backend/acl/sink_test.go

@@ -11,7 +11,6 @@ import (
 )
 
 func Test_FactoryConsumeOnlyClientCannotPublish(t *testing.T) {
-	assert := require.New(t)
 
 	c, err := ConfigFromString(fmt.Sprintf(`
 default:
@@ -37,7 +36,7 @@ clients:
 		Topic: "dogs",
 	})
 
-	assert.Equal(err, ErrUnauthorized)
+	assertPermissionDenied(t, err, "no publish permissions for topic dogs")
 }
 
 func Test_FactoryPublishOnlyClientCanPublish(t *testing.T) {

backend/acl/source.go

@@ -6,6 +6,8 @@ import (
 	"github.com/uw-labs/proximo"
 	"github.com/uw-labs/proximo/proto"
 	"github.com/uw-labs/substrate"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 type AsyncSourceFactory struct {
@@ -20,7 +22,7 @@ func (s AsyncSourceFactory) NewAsyncSource(ctx context.Context, req *proto.Start
 	}
 
 	if !containsRegex(scope.Consume, req.Topic) {
-		return nil, ErrUnauthorized
+		return nil, status.Errorf(codes.PermissionDenied, "no consume permissions for topic %v", req.Topic)
 	}
 
 	return s.Next.NewAsyncSource(ctx, req)

backend/acl/source_test.go

@@ -9,7 +9,6 @@ import (
 )
 
 func Test_FactoryPublishOnlyClientCannotConsume(t *testing.T) {
-	assert := require.New(t)
 
 	c, err := ConfigFromString(fmt.Sprintf(`
 default:
@@ -35,7 +34,7 @@ clients:
 		Topic: "dogs",
 	})
 
-	assert.Equal(err, ErrUnauthorized)
+	assertPermissionDenied(t, err, "no consume permissions for topic dogs")
 }
 
 func Test_FactoryConsumeOnlyClientCanConsume(t *testing.T) {