Fix: Improve error handling for Server API by kfahad5607 · Pull Request #170 · stack-auth/stack-auth

kfahad5607 · Aug 4, 2024

Fixes #141 by checking for entities before deleting/modifying them to avoid prisma query error.

Route handler changes

Checking if team membership exists in Remove a user from a team
Checking if team and user exist in Grant a team permission to a user
Checking if team-permission for user exists in Revoke a team permission from a user
Checking if team exists in Delete a team
Checking if user exists in Update user
Checking if team membership exists when selected_team_id is passed in request body in Update user
Checking if user exists in Delete user

Other changes

Updated selectedTeamIdSchema to validate string as uuid
Added new helper function ensureUserTeamPermissionExist in request-checks to use in Revoke a team permission from a user
Added new error UserTeamPermissionNotFound to use in ensureUserTeamPermissionExist

…ss type

…1_error-handling-in-api-handlers

vercel · Aug 4, 2024

Someone is attempting to deploy a commit to the Stack Team on Vercel.

A member of the Team first needs to authorize it.

CLAassistant · Aug 4, 2024

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ fomalhautb
❌ Fahad Khan

Fahad Khan seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

fomalhautb

Looks pretty clean! Also can you sign the CLA?

fomalhautb · Aug 4, 2024

apps/backend/src/lib/request-checks.tsx

  }
 }

+export async function ensureUserTeamPermissionExist(


I think this function is a little bit duplicated to ensureUserHasTeamPermission. Maybe you can combine them.

I am combining these functions, but logically, they signify different types of errors.

ensureUserHasTeamPermission

This function throws a TeamPermissionRequired error, which indicates an authorization error. Users might misconstrue this error as a permission issue in the case of the Revoke a team permission from a user API request.

ensureUserTeamPermissionExist

This function throws a UserTeamPermissionNotFound error, indicating that the permission the user is trying to delete does not exist. This is more appropriate for the Revoke a team permission from a user API request.

yeah, I added errorType parameter to decide which type of error to throw in the ensureUserHasTeamPermission function.

fomalhautb · Aug 4, 2024

apps/backend/src/app/api/v1/users/crud.tsx


+      // If the selected_team_id is present and we reach here that means user does exist. Hence, we have this check.
+      if (!data.selected_team_id) {
+        await ensureUserExist(tx, { projectId: auth.project.id, userId: params.user_id });


We can move this check to the beginning and remove the condition so it is easier to follow

… string in 'ensureUserHasTeamPermission'

…1_error-handling-in-api-handlers

kfahad5607 · Aug 5, 2024

I have made the requested changes.

Deleted the ensureUserTeamPermissionExist function and UserTeamPermissionNotFound error.
Updated the ensureUserHasTeamPermission function to accept both System Permission and Custom Permission via options.permissionId.
Checking for an existing membership between the team and user, instead of performing individual checks for the user and team in Grant a team permission to a user.

PS: I have also signed the CLA.

N2D4 · Aug 7, 2024

FYI, looks like the bot hasn't picked up the CLA, but I can confirm that you signed it, so all good!

vercel · Aug 9, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
stack-demo	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 9, 2024 11:51pm

fomalhautb · Aug 9, 2024

Thanks for the contribution!

* Added entity checks to provide better errors in API for 'server' access type * Removed 'ensureUserTeamPermissionExist', changed permissionId type to string in 'ensureUserHasTeamPermission' * added different error types for user team permission --------- Co-authored-by: Fahad Khan <fahad.khan@net-mon.net> Co-authored-by: Zai Shi <zaishi00@outlook.com>

* Team invitation (#171) * team invitation wip * implemented handler * team invitation callback wip * added team invitation frontend * fixed listCurrentUserTeamPermissions * added team invitation email template * fixed bugs * fixed verification code handler * added more checks to team invitation verification * fixed team invitation page * restructured verification code handler * fixed frontend * fixed team invitation tests * added more team invitation test * fixed bug * added migration file * removed unused code * Allow Next.js version `latest` in package.json * Fix typo * Update error message * Remove unnecessary console.warn * Updated "edit this page" button * Hide unsupported properties from docs * OAuth token tests * Fix typo * added create user button * added create user button (#173) * added basic team settings * Create SECURITY.md * added editable text * added more team settings * Export button in tables * Export all pages of tables * Update security policy * Fix docs typo * More docs typos * Improved user creation handlers * added list users on client * updated team-settings * hide team setting component for now * Fix: Improve error handling for Server API (#170) * Added entity checks to provide better errors in API for 'server' access type * Removed 'ensureUserTeamPermissionExist', changed permissionId type to string in 'ensureUserHasTeamPermission' * added different error types for user team permission --------- Co-authored-by: Fahad Khan <fahad.khan@net-mon.net> Co-authored-by: Zai Shi <zaishi00@outlook.com> * added ensureClientUserAuthenticated * improved error handling * removed unused imports * fixed bug * added member list * Sign up restriction button on dashboard Fix #66, #74 * moved data table to stack-ui * added remove user modal * fixed chokidar * updated ui * fixed merge * fixed merge * fixed merge * updated settings component * improved mobile styles * added user invitation ui * added team creation page * added team creation to team component * added setting icon to team switcher * added settings sections * added client_team_creation_enabled * added frontend team creation enabled checks * updated demo page * added member profile update * fixed profile editing * added leave team button * added create/delete team redirect * fixed column header, updated team setting * fixed account setting padding * updated tests --------- Co-authored-by: Stan Wohlwend <n2d4xc@gmail.com> Co-authored-by: Fahad Khan <62707456+kfahad5607@users.noreply.github.com> Co-authored-by: Fahad Khan <fahad.khan@net-mon.net>

* Team invitation (#171) * team invitation wip * implemented handler * team invitation callback wip * added team invitation frontend * fixed listCurrentUserTeamPermissions * added team invitation email template * fixed bugs * fixed verification code handler * added more checks to team invitation verification * fixed team invitation page * restructured verification code handler * fixed frontend * fixed team invitation tests * added more team invitation test * fixed bug * added migration file * removed unused code * Allow Next.js version `latest` in package.json * Fix typo * Update error message * Remove unnecessary console.warn * Updated "edit this page" button * Hide unsupported properties from docs * OAuth token tests * Fix typo * added create user button (#173) * Create SECURITY.md * Export button in tables * Export all pages of tables * Update security policy * Fix docs typo * More docs typos * Improved user creation handlers * Fix: Improve error handling for Server API (#170) * Added entity checks to provide better errors in API for 'server' access type * Removed 'ensureUserTeamPermissionExist', changed permissionId type to string in 'ensureUserHasTeamPermission' * added different error types for user team permission --------- Co-authored-by: Fahad Khan <fahad.khan@net-mon.net> Co-authored-by: Zai Shi <zaishi00@outlook.com> * Sign up restriction button on dashboard Fix #66, #74 * Fix type error * TOTP 2FA endpoints * TOTP MFA components * Improved description for disabling sign ups * Added 'allowedErrorTypes' for error propagation --------- Co-authored-by: Zai Shi <zaishi00@outlook.com> Co-authored-by: Stan Wohlwend <n2d4xc@gmail.com> Co-authored-by: Fahad Khan <fahad.khan@net-mon.net>

) * Team invitation (#171) * team invitation wip * implemented handler * team invitation callback wip * added team invitation frontend * fixed listCurrentUserTeamPermissions * added team invitation email template * fixed bugs * fixed verification code handler * added more checks to team invitation verification * fixed team invitation page * restructured verification code handler * fixed frontend * fixed team invitation tests * added more team invitation test * fixed bug * added migration file * removed unused code * Allow Next.js version `latest` in package.json * Fix typo * Update error message * Remove unnecessary console.warn * Updated "edit this page" button * Hide unsupported properties from docs * OAuth token tests * Fix typo * added create user button (#173) * Create SECURITY.md * Export button in tables * Export all pages of tables * Update security policy * Fix docs typo * More docs typos * Improved user creation handlers * Fix: Improve error handling for Server API (#170) * Added entity checks to provide better errors in API for 'server' access type * Removed 'ensureUserTeamPermissionExist', changed permissionId type to string in 'ensureUserHasTeamPermission' * added different error types for user team permission --------- Co-authored-by: Fahad Khan <fahad.khan@net-mon.net> Co-authored-by: Zai Shi <zaishi00@outlook.com> * Sign up restriction button on dashboard Fix #66, #74 * Fix type error * TOTP 2FA endpoints * TOTP MFA components * Improved description for disabling sign ups * Removed 'selected_team_id' from create user schema --------- Co-authored-by: Zai Shi <zaishi00@outlook.com> Co-authored-by: Stan Wohlwend <n2d4xc@gmail.com> Co-authored-by: Fahad Khan <fahad.khan@net-mon.net>

fahad-netmon added 2 commits August 4, 2024 18:08

Added entity checks to provide better errors in API for 'server' acce…

5ae3dbf

…ss type

Merge branch 'dev' of https://github.com/kfahad5607/stack into fix/14…

1d71b98

…1_error-handling-in-api-handlers

fomalhautb requested changes Aug 4, 2024

View reviewed changes

fahad-netmon added 2 commits August 5, 2024 22:00

Removed 'ensureUserTeamPermissionExist', changed permissionId type to…

bd49459

… string in 'ensureUserHasTeamPermission'

Merge branch 'dev' of https://github.com/kfahad5607/stack into fix/14…

c279601

…1_error-handling-in-api-handlers

added different error types for user team permission

1efdefb

vercel bot deployed to Preview – stack-demo August 9, 2024 23:51 View deployment

fomalhautb merged commit 2fef40b into stack-auth:dev Aug 9, 2024

kfahad5607 deleted the fix/141_error-handling-in-api-handlers branch August 10, 2024 10:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: Improve error handling for Server API#170

Fix: Improve error handling for Server API#170
fomalhautb merged 5 commits intostack-auth:devstack-auth/stack-auth:devfrom
kfahad5607:fix/141_error-handling-in-api-handlerskfahad5607/stack:fix/141_error-handling-in-api-handlersCopy head branch name to clipboard

kfahad5607 commented Aug 4, 2024

Uh oh!

vercel bot commented Aug 4, 2024

Uh oh!

CLAassistant commented Aug 4, 2024 •

edited

Loading

Uh oh!

fomalhautb left a comment •

edited

Loading

Uh oh!

fomalhautb Aug 4, 2024 •

edited

Loading

Uh oh!

kfahad5607 Aug 5, 2024

Uh oh!

fomalhautb Aug 9, 2024

Uh oh!

fomalhautb Aug 4, 2024

Uh oh!

kfahad5607 commented Aug 5, 2024

Uh oh!

N2D4 commented Aug 7, 2024

Uh oh!

vercel bot commented Aug 9, 2024 •

edited

Loading

Uh oh!

fomalhautb commented Aug 9, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Search code, repositories, users, issues, pull requests...

Conversation

kfahad5607 commented Aug 4, 2024

Route handler changes

Other changes

Uh oh!

vercel bot commented Aug 4, 2024

Uh oh!

CLAassistant commented Aug 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fomalhautb left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fomalhautb Aug 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfahad5607 Aug 5, 2024

Choose a reason for hiding this comment

Uh oh!

fomalhautb Aug 9, 2024

Choose a reason for hiding this comment

Uh oh!

fomalhautb Aug 4, 2024

Choose a reason for hiding this comment

Uh oh!

kfahad5607 commented Aug 5, 2024

Uh oh!

N2D4 commented Aug 7, 2024

Uh oh!

vercel bot commented Aug 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fomalhautb commented Aug 9, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

CLAassistant commented Aug 4, 2024 •

edited

Loading

fomalhautb left a comment •

edited

Loading

fomalhautb Aug 4, 2024 •

edited

Loading

vercel bot commented Aug 9, 2024 •

edited

Loading