irl/cloud-api
1
0
Fork 0
forked from sr2/cloud-api
Code Pull requests Activity

feat: more accurate status codes

Browse source 
403 Forbidden replacing many 401 Unauthorized usages.
This commit is contained in:
Chris Milne 2026-06-11 14:58:05 +01:00
parent b3ae655009
commit c2e035dede
11 changed files with 81 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/auth/dependencies.py
View file

@ -11,6 +11,7 @@ Exports:
from typing import Annotated
from fastapi import Depends
from src.exceptions import ForbiddenException
from src.user.dependencies import user_model_claims_dependency
from src.user.models import User
from src.organisation.dependencies import (
@ -19,8 +20,6 @@ from src.organisation.dependencies import (
)
from src.organisation.models import Organisation as Org
from src.auth.exceptions import UnauthorizedException
async def org_query_user_claims(
org_model: org_model_query_dependency, user_model: user_model_claims_dependency
@ -28,7 +27,7 @@ async def org_query_user_claims(
if user_model in org_model.user_rel:
return True
raise UnauthorizedException()
raise ForbiddenException()
org_query_user_claims_dependency = Annotated[bool, Depends(org_query_user_claims)]
@ -45,10 +44,10 @@ async def org_query_root_claims(
try:
if await user_model_super_admin(user_model, su_emails):
return org_model
except UnauthorizedException:
except ForbiddenException:
pass
raise UnauthorizedException(message="Must be the org's root user")
raise ForbiddenException(message="Must be the org's root user")
org_model_root_claim_query_dependency = Annotated[
@ -67,10 +66,10 @@ async def org_body_root_claims(
try:
if await user_model_super_admin(user_model, su_emails):
return org_model
except UnauthorizedException:
except ForbiddenException:
pass
raise UnauthorizedException(message="Must be the org's root user")
raise ForbiddenException(message="Must be the org's root user")
org_model_root_claim_body_dependency = Annotated[
@ -99,7 +98,7 @@ async def user_model_super_admin(
if user_model.email in super_admin_emails:
return user_model
raise UnauthorizedException(message="Must be super admin")
raise ForbiddenException(message="Must be super admin")
super_admin_dependency = Annotated[type[User], Depends(user_model_super_admin)]