Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2025-03-10 22:22:45 -05:00
Code Issues Activity

fix(core): set oidc access denied error code to 403 (#5725)

Browse source
This commit is contained in:
wangsijie 2024-04-17 10:27:47 +08:00 • committed by GitHub
parent d48094be27
commit d545303568
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
.changeset/forty-grapes-relax.md Normal file
View file

@ -0,0 +1,7 @@
---
'@logto/core': patch
---
Fix OIDC AccessDenied error code to 403.
This error may happen when you try to grant an access token to a user lacking the required permissions, especially when granting for orgnization related resources. The error code should be 403 instead of 400.

8
packages/core/src/oidc/grants/refresh-token.ts
View file

@ -229,7 +229,9 @@ export const buildHandler: (
if (organizationId) { if (organizationId) {
// Check membership // Check membership
if (!(await queries.organizations.relations.users.exists(organizationId, account.accountId))) { if (!(await queries.organizations.relations.users.exists(organizationId, account.accountId))) {
throw new AccessDenied('user is not a member of the organization'); const error = new AccessDenied('user is not a member of the organization');
error.statusCode = 403;
throw error;
} }
// Check if the organization is granted (third-party application only) by the user // Check if the organization is granted (third-party application only) by the user
@ -242,7 +244,9 @@ export const buildHandler: (
organizationId organizationId
)) ))
) { ) {
throw new AccessDenied('organization access is not granted to the application'); const error = new AccessDenied('organization access is not granted to the application');
error.statusCode = 403;
throw error;
} }
} }
/* === End RFC 0001 === */ /* === End RFC 0001 === */

2
packages/integration-tests/src/tests/api/oidc/refresh-token-grant.test.ts
View file

@ -40,7 +40,7 @@ const grantErrorContaining = (code: string, description: string, status = 400) =
const accessDeniedError = grantErrorContaining( const accessDeniedError = grantErrorContaining(
'oidc.access_denied', 'oidc.access_denied',
'user is not a member of the organization', 'user is not a member of the organization',
400 403
); );
const issuer = defaultConfig.endpoint + '/oidc'; const issuer = defaultConfig.endpoint + '/oidc';