From d977ea9dc41cd226985fee3374a39e669a32fc42 Mon Sep 17 00:00:00 2001 From: gale-popai Date: Tue, 28 Jul 2026 12:42:20 +0300 Subject: [PATCH] fix(api): tell callers why a request was forbidden (#610) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(api): tell callers why a request was forbidden The scope filter already computes an exact reason ("Missing API token scope: skill:delete", "API token cannot access endpoint: /x") and the access-denied handler discarded it, returning a bare "Forbidden" for every case: missing scope, endpoint closed to API tokens, and paths that simply don't exist. Clients cannot tell those apart, so they guess — the published CLI reports every 403 as "token may lack required scope", which sent us debugging token scopes for an hour when the real causes were a revoked token and a mistyped namespace path. The reason now rides in the response via a new error.forbidden.detail message (en + zh), and is logged alongside the exception type. Signed-off-by: Gal Eyal Co-Authored-By: Claude Fable 5 * fix(api): safely expose API token denial reasons Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Co-authored-by: Claude Fable 5 Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --- cli/src/clients/skillhub-client.ts | 32 +++- cli/src/shared/output.ts | 3 + cli/test/helpers/fake-registry.ts | 8 +- cli/test/integration/publish-dry-run.test.ts | 1 + cli/test/unit/clients/skillhub-client.test.ts | 48 +++++- cli/test/unit/shared/output.test.ts | 2 + docs/03-authentication-design.md | 1 + docs/skillhub/en/guide/cli.md | 2 + docs/skillhub/guide/cli.md | 2 + .../security/ApiAccessDeniedHandler.java | 18 ++- .../src/main/resources/messages.properties | 2 + .../src/main/resources/messages_zh.properties | 2 + .../security/ApiAccessDeniedHandlerTest.java | 137 ++++++++++++++++++ .../token/ApiTokenAccessDeniedException.java | 42 ++++++ .../auth/token/ApiTokenScopeFilter.java | 10 +- .../auth/token/ApiTokenScopeFilterTest.java | 10 ++ 16 files changed, 302 insertions(+), 18 deletions(-) create mode 100644 server/skillhub-app/src/test/java/com/iflytek/skillhub/security/ApiAccessDeniedHandlerTest.java create mode 100644 server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenAccessDeniedException.java diff --git a/cli/src/clients/skillhub-client.ts b/cli/src/clients/skillhub-client.ts index 14e14ec3..8d008483 100644 --- a/cli/src/clients/skillhub-client.ts +++ b/cli/src/clients/skillhub-client.ts @@ -52,6 +52,11 @@ export interface DryRunResponse { resolvedVersion: string | null } +interface ErrorEnvelope { + msg?: unknown + requestId?: unknown +} + export class SkillHubClient { constructor( readonly registry: string, @@ -88,9 +93,12 @@ export class SkillHubClient { } catch { throw new CliError('registry unreachable', EXIT.network, { registry: this.registry, next: 'check network or pass --registry' }) } - if (response.status === 401 || response.status === 403) { + if (response.status === 401) { throw new CliError('authentication failed', EXIT.auth, { registry: this.registry, next: 'run `skillhub login`' }) } + if (response.status === 403) { + throw await this.createAccessDeniedError(response) + } if (response.status === 404) { throw new CliError('skill or version not found', EXIT.generic, { registry: this.registry }) } @@ -155,7 +163,7 @@ export class SkillHubClient { throw new CliError('authentication failed', EXIT.auth, { registry: this.registry, next: 'run `skillhub login`' }) } if (response.status === 403) { - throw new CliError('access denied — token may lack required scope', EXIT.auth, { registry: this.registry, next: 'regenerate token with required scopes or run `skillhub login`' }) + throw await this.createAccessDeniedError(response) } if (response.status === 404) { throw new CliError('resource not found', EXIT.generic, { registry: this.registry }) @@ -172,6 +180,26 @@ export class SkillHubClient { return body.data as T } + private async createAccessDeniedError(response: Response): Promise { + const error = await this.readErrorEnvelope(response) + return new CliError(error.message ?? 'access denied', EXIT.auth, { + registry: this.registry, + ...(error.requestId ? { requestId: error.requestId } : {}) + }) + } + + private async readErrorEnvelope(response: Response): Promise<{ message?: string; requestId?: string }> { + try { + const body = await response.json() as ErrorEnvelope + return { + ...(typeof body.msg === 'string' && body.msg.trim() ? { message: body.msg } : {}), + ...(typeof body.requestId === 'string' && body.requestId.trim() ? { requestId: body.requestId } : {}) + } + } catch { + return {} + } + } + private headers(): HeadersInit { return this.token ? { Authorization: `Bearer ${this.token}` } : {} } diff --git a/cli/src/shared/output.ts b/cli/src/shared/output.ts index 9b2eafd9..977116bc 100644 --- a/cli/src/shared/output.ts +++ b/cli/src/shared/output.ts @@ -30,6 +30,9 @@ export function renderError(error: unknown, json: boolean): string { if (typeof cliError.details.path === 'string') { lines.push(`Context: path ${cliError.details.path}`) } + if (typeof cliError.details.requestId === 'string') { + lines.push(`Request ID: ${cliError.details.requestId}`) + } if (typeof cliError.details.next === 'string') { lines.push(`Next: ${cliError.details.next}`) } diff --git a/cli/test/helpers/fake-registry.ts b/cli/test/helpers/fake-registry.ts index a3ea9ef8..4fde3a95 100644 --- a/cli/test/helpers/fake-registry.ts +++ b/cli/test/helpers/fake-registry.ts @@ -22,7 +22,7 @@ export function createFakeRegistry(handlers: Record) { /** * Controls how a specific endpoint behaves when a failure is injected: * 'auth' => 401 { code: 401, message: 'unauthorized' } - * 'forbidden' => 403 { code: 403, message: 'forbidden' } + * 'forbidden' => 403 with a standard SkillHub error envelope * 'not_found' => 404 { code: 404, message: 'not found' } * 'server_error' => 500 { code: 500, message: 'internal error' } * 'network' => handler throws, causing fetch() to reject with a TypeError @@ -34,7 +34,11 @@ function failureResponse(mode: FailureMode): Response { case 'auth': return Response.json({ code: 401, message: 'unauthorized' }, { status: 401 }) case 'forbidden': - return Response.json({ code: 403, message: 'forbidden' }, { status: 403 }) + return Response.json({ + code: 403, + msg: 'API token is missing required scope: skill:publish', + requestId: 'req-test-forbidden' + }, { status: 403 }) case 'not_found': return Response.json({ code: 404, message: 'not found' }, { status: 404 }) case 'server_error': diff --git a/cli/test/integration/publish-dry-run.test.ts b/cli/test/integration/publish-dry-run.test.ts index deabb7b2..456572d1 100644 --- a/cli/test/integration/publish-dry-run.test.ts +++ b/cli/test/integration/publish-dry-run.test.ts @@ -172,5 +172,6 @@ describe('publish --dry-run', () => { expect(result.exitCode).toBe(2) expect(result.stderr).toContain('scope') + expect(result.stderr).toContain('Request ID: req-test-forbidden') }) }) diff --git a/cli/test/unit/clients/skillhub-client.test.ts b/cli/test/unit/clients/skillhub-client.test.ts index c07083c2..e545e99f 100644 --- a/cli/test/unit/clients/skillhub-client.test.ts +++ b/cli/test/unit/clients/skillhub-client.test.ts @@ -37,12 +37,21 @@ describe('SkillHubClient', () => { }) test('download() throws auth error on 403', async () => { - const fetchImpl = (async () => new Response(null, { status: 403 })) as unknown as typeof fetch + const fetchImpl = (async () => Response.json({ + code: 403, + msg: 'API token is missing required scope: skill:read', + requestId: 'req-download' + }, { status: 403 })) as unknown as typeof fetch const client = new SkillHubClient('http://registry.test', 'token', fetchImpl) - const err = expect(client.download('ns', 'slug')).rejects - await err.toBeInstanceOf(CliError) - await err.toHaveProperty('message', 'authentication failed') - await err.toHaveProperty('exitCode', EXIT.auth) + + await expect(client.download('ns', 'slug')).rejects.toMatchObject({ + message: 'API token is missing required scope: skill:read', + exitCode: EXIT.auth, + details: { + registry: 'http://registry.test', + requestId: 'req-download' + } + }) }) test('download() throws not-found error on 404', async () => { @@ -159,6 +168,35 @@ describe('SkillHubClient', () => { // --- handleJsonResponse() non-2xx classification --- + test('whoami() surfaces server reason and request ID on 403', async () => { + const fetchImpl = (async () => Response.json({ + code: 403, + msg: 'API token cannot access endpoint: /api/cli/v1/whoami', + requestId: 'req-610' + }, { status: 403 })) as unknown as typeof fetch + const client = new SkillHubClient('http://registry.test', 'token', fetchImpl) + + await expect(client.whoami()).rejects.toMatchObject({ + message: 'API token cannot access endpoint: /api/cli/v1/whoami', + exitCode: EXIT.auth, + details: { + registry: 'http://registry.test', + requestId: 'req-610' + } + }) + }) + + test('whoami() falls back to generic access denied when 403 body is invalid', async () => { + const fetchImpl = (async () => new Response('not-json', { status: 403 })) as unknown as typeof fetch + const client = new SkillHubClient('http://registry.test', 'token', fetchImpl) + + await expect(client.whoami()).rejects.toMatchObject({ + message: 'access denied', + exitCode: EXIT.auth, + details: { registry: 'http://registry.test' } + }) + }) + test('whoami() throws generic error on 500', async () => { const fetchImpl = (async () => new Response(null, { status: 500 })) as unknown as typeof fetch const client = new SkillHubClient('http://registry.test', 'token', fetchImpl) diff --git a/cli/test/unit/shared/output.test.ts b/cli/test/unit/shared/output.test.ts index 8d051172..d71bcce0 100644 --- a/cli/test/unit/shared/output.test.ts +++ b/cli/test/unit/shared/output.test.ts @@ -16,11 +16,13 @@ describe('renderError', () => { test('renders human error without stack trace', () => { const error = new CliError('registry unreachable', 3, { registry: 'https://registry.example.com', + requestId: 'req-610', next: 'check network or pass --registry' }) expect(renderError(error, false)).toBe([ 'Error: registry unreachable', 'Context: registry https://registry.example.com', + 'Request ID: req-610', 'Next: check network or pass --registry' ].join('\n')) }) diff --git a/docs/03-authentication-design.md b/docs/03-authentication-design.md index b4fb0cd1..2be902e8 100644 --- a/docs/03-authentication-design.md +++ b/docs/03-authentication-design.md @@ -379,6 +379,7 @@ API Token 仍保留，但定位从“CLI 唯一认证方式”调整为“平台 - 校验：从 `Authorization: Bearer ` 提取 → 哈希比对 → 加载关联用户 → 检查用户状态 - 失败闭合：公共读接口只有在缺少 `Authorization` 头时才按匿名访问处理；只要出现 Bearer 凭证，空值、格式错误、未知、过期、已吊销、用户缺失或用户禁用均返回 401，不能回退为匿名访问 - 作用域：`skill:read`, `skill:publish`, `skill:delete`, `token:manage` +- 拒绝原因：API Token 缺少作用域或不能访问某个接口时，403 响应返回本地化的安全原因和 `requestId`；其他授权失败仍返回通用信息，避免暴露内部异常 > **一期作用域说明（非最小权限）**：一期 Token 作用域为粗粒度动作级别，不与 namespace 绑定。Token 继承用户的全部权限——如果用户是某个 namespace 的 MEMBER，则该用户的任何 Token（只要包含 `skill:publish` scope）都可以向该 namespace 发布技能。这是有意的一期简化，不满足最小权限原则。后续版本计划引入 namespace 级别的 Token 作用域限定（如 `namespace:ai-team:skill:publish`），或通过 `api_token_scope` 子表实现 Token 与 namespace 的绑定。 diff --git a/docs/skillhub/en/guide/cli.md b/docs/skillhub/en/guide/cli.md index 6cbc779c..e4fa2842 100644 --- a/docs/skillhub/en/guide/cli.md +++ b/docs/skillhub/en/guide/cli.md @@ -83,6 +83,8 @@ skillhub login --token sk_xxx --registry https://skillhub.example.com `login` validates the token, stores it in `~/.skillhub/credentials.json`, and writes the registry to `~/.skillhub/config.json`. +When an API-token request is denied, the CLI shows the safe reason returned by the server and its `Request ID`. Use that ID to correlate the failure with server logs. Other authorization failures continue to use a generic message. + ### Check Current Identity ```bash diff --git a/docs/skillhub/guide/cli.md b/docs/skillhub/guide/cli.md index 22162d56..dfadf6d3 100644 --- a/docs/skillhub/guide/cli.md +++ b/docs/skillhub/guide/cli.md @@ -83,6 +83,8 @@ skillhub login --token sk_xxx --registry https://skillhub.example.com `login` 会验证 token 有效性，然后将 token 存储到 `~/.skillhub/credentials.json`，同时将 registry 写入 `~/.skillhub/config.json`。 +API Token 请求被拒绝时，CLI 会显示服务端返回的具体原因和 `Request ID`。排查问题时可使用该 ID 对照服务端日志；非 API Token 的授权失败仍只显示通用信息。 + ### 查看当前身份 ```bash diff --git a/server/skillhub-app/src/main/java/com/iflytek/skillhub/security/ApiAccessDeniedHandler.java b/server/skillhub-app/src/main/java/com/iflytek/skillhub/security/ApiAccessDeniedHandler.java index 81cebbde..2c930aa6 100644 --- a/server/skillhub-app/src/main/java/com/iflytek/skillhub/security/ApiAccessDeniedHandler.java +++ b/server/skillhub-app/src/main/java/com/iflytek/skillhub/security/ApiAccessDeniedHandler.java @@ -1,6 +1,7 @@ package com.iflytek.skillhub.security; import com.fasterxml.jackson.databind.ObjectMapper; +import com.iflytek.skillhub.auth.token.ApiTokenAccessDeniedException; import com.iflytek.skillhub.dto.ApiResponse; import com.iflytek.skillhub.dto.ApiResponseFactory; import jakarta.servlet.http.HttpServletRequest; @@ -38,14 +39,25 @@ public class ApiAccessDeniedHandler implements AccessDeniedHandler { public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException { + ApiTokenAccessDeniedException apiTokenException = + accessDeniedException instanceof ApiTokenAccessDeniedException typedException + ? typedException + : null; logger.info( - "Forbidden API request [requestId={}, method={}, path={}, reason={}]", + "Forbidden API request [requestId={}, method={}, path={}, reason={}, detail={}]", MDC.get("requestId"), request.getMethod(), sensitiveLogSanitizer.sanitizeRequestTarget(request), - accessDeniedException.getClass().getSimpleName() + accessDeniedException.getClass().getSimpleName(), + apiTokenException != null ? apiTokenException.getMessage() : null ); - ApiResponse body = apiResponseFactory.error(403, "error.forbidden"); + ApiResponse body = apiTokenException != null + ? apiResponseFactory.error( + 403, + apiTokenException.getMessageCode(), + apiTokenException.getMessageArgs() + ) + : apiResponseFactory.error(403, "error.forbidden"); response.setStatus(HttpServletResponse.SC_FORBIDDEN); response.setContentType(MediaType.APPLICATION_JSON_VALUE); objectMapper.writeValue(response.getOutputStream(), body); diff --git a/server/skillhub-app/src/main/resources/messages.properties b/server/skillhub-app/src/main/resources/messages.properties index 19189122..79195af7 100644 --- a/server/skillhub-app/src/main/resources/messages.properties +++ b/server/skillhub-app/src/main/resources/messages.properties @@ -48,6 +48,8 @@ error.auth.sessionBootstrap.providerUnsupported=Unsupported session bootstrap pr error.auth.sessionBootstrap.notAuthenticated=No authenticated external session found error.badRequest=Invalid request error.forbidden=Forbidden +error.apiToken.scope.missing=API token is missing required scope: {0} +error.apiToken.endpoint.unsupported=API token cannot access endpoint: {0} error.request.timeout=Request timed out error.rateLimit.exceeded=Rate limit exceeded error.storage.unavailable=Object storage is temporarily unavailable. Please try again later. diff --git a/server/skillhub-app/src/main/resources/messages_zh.properties b/server/skillhub-app/src/main/resources/messages_zh.properties index 6885dfd3..d7b6b11b 100644 --- a/server/skillhub-app/src/main/resources/messages_zh.properties +++ b/server/skillhub-app/src/main/resources/messages_zh.properties @@ -48,6 +48,8 @@ error.auth.sessionBootstrap.providerUnsupported=不支持的会话引导提供 error.auth.sessionBootstrap.notAuthenticated=未检测到已认证的外部会话 error.badRequest=请求参数不合法 error.forbidden=没有权限执行该操作 +error.apiToken.scope.missing=API 令牌缺少所需权限范围：{0} +error.apiToken.endpoint.unsupported=API 令牌无法访问接口：{0} error.request.timeout=请求超时 error.rateLimit.exceeded=请求过于频繁，请稍后再试 error.storage.unavailable=对象存储暂时不可用，请稍后再试 diff --git a/server/skillhub-app/src/test/java/com/iflytek/skillhub/security/ApiAccessDeniedHandlerTest.java b/server/skillhub-app/src/test/java/com/iflytek/skillhub/security/ApiAccessDeniedHandlerTest.java new file mode 100644 index 00000000..db8982b7 --- /dev/null +++ b/server/skillhub-app/src/test/java/com/iflytek/skillhub/security/ApiAccessDeniedHandlerTest.java @@ -0,0 +1,137 @@ +package com.iflytek.skillhub.security; + +import static org.assertj.core.api.Assertions.assertThat; + +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.iflytek.skillhub.auth.token.ApiTokenScopeFilter; +import com.iflytek.skillhub.auth.token.ApiTokenScopeService; +import com.iflytek.skillhub.auth.policy.RouteSecurityPolicyRegistry; +import com.iflytek.skillhub.auth.rbac.PlatformPrincipal; +import com.iflytek.skillhub.dto.ApiResponseFactory; +import jakarta.servlet.FilterChain; +import java.time.Clock; +import java.time.Instant; +import java.time.ZoneOffset; +import java.util.List; +import java.util.Locale; +import java.util.Set; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.slf4j.MDC; +import org.springframework.context.i18n.LocaleContextHolder; +import org.springframework.context.support.ResourceBundleMessageSource; +import org.springframework.mock.web.MockHttpServletRequest; +import org.springframework.mock.web.MockHttpServletResponse; +import org.springframework.security.access.AccessDeniedException; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.authority.SimpleGrantedAuthority; +import org.springframework.security.core.context.SecurityContextHolder; + +class ApiAccessDeniedHandlerTest { + + private final ObjectMapper objectMapper = new ObjectMapper().findAndRegisterModules(); + private ApiAccessDeniedHandler handler; + + @BeforeEach + void setUp() { + ResourceBundleMessageSource messageSource = new ResourceBundleMessageSource(); + messageSource.setBasename("messages"); + messageSource.setDefaultEncoding("UTF-8"); + ApiResponseFactory responseFactory = new ApiResponseFactory( + messageSource, + Clock.fixed(Instant.parse("2026-07-28T00:00:00Z"), ZoneOffset.UTC) + ); + handler = new ApiAccessDeniedHandler( + objectMapper, + responseFactory, + new SensitiveLogSanitizer() + ); + MDC.put("requestId", "req-610"); + LocaleContextHolder.setLocale(Locale.ENGLISH); + } + + @AfterEach + void tearDown() { + MDC.clear(); + LocaleContextHolder.resetLocaleContext(); + SecurityContextHolder.clearContext(); + } + + @Test + void shouldExposeLocalizedApiTokenScopeReasonAndRequestId() throws Exception { + MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/publish"); + MockHttpServletResponse response = new MockHttpServletResponse(); + ApiTokenScopeService scopeService = + new ApiTokenScopeService(objectMapper, new RouteSecurityPolicyRegistry()); + ApiTokenScopeFilter filter = new ApiTokenScopeFilter(scopeService, handler); + PlatformPrincipal principal = new PlatformPrincipal( + "user-1", + "Alice", + "alice@example.com", + "", + "api_token", + Set.of("USER") + ); + SecurityContextHolder.getContext().setAuthentication( + new UsernamePasswordAuthenticationToken( + principal, + null, + List.of(new SimpleGrantedAuthority("SCOPE_skill:read")) + ) + ); + FilterChain chain = (servletRequest, servletResponse) -> { + throw new AssertionError("Denied request must not continue"); + }; + + filter.doFilter(request, response, chain); + + JsonNode body = objectMapper.readTree(response.getContentAsByteArray()); + assertThat(response.getStatus()).isEqualTo(403); + assertThat(body.path("msg").asText()) + .isEqualTo("API token is missing required scope: skill:publish"); + assertThat(body.path("requestId").asText()).isEqualTo("req-610"); + } + + @Test + void shouldTranslateSafeApiTokenReason() throws Exception { + LocaleContextHolder.setLocale(Locale.SIMPLIFIED_CHINESE); + MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api/cli/v1/whoami"); + MockHttpServletResponse response = new MockHttpServletResponse(); + ApiTokenScopeService scopeService = + new ApiTokenScopeService(objectMapper, new RouteSecurityPolicyRegistry()); + ApiTokenScopeFilter filter = new ApiTokenScopeFilter(scopeService, handler); + PlatformPrincipal principal = new PlatformPrincipal( + "user-1", + "Alice", + "alice@example.com", + "", + "api_token", + Set.of("USER") + ); + SecurityContextHolder.getContext().setAuthentication( + new UsernamePasswordAuthenticationToken(principal, null, List.of()) + ); + + filter.doFilter(request, response, (servletRequest, servletResponse) -> { + throw new AssertionError("Denied request must not continue"); + }); + + JsonNode body = objectMapper.readTree(response.getContentAsByteArray()); + assertThat(body.path("msg").asText()) + .isEqualTo("API 令牌无法访问接口：/api/cli/v1/whoami"); + } + + @Test + void shouldHideGenericAccessDeniedExceptionMessage() throws Exception { + MockHttpServletRequest request = new MockHttpServletRequest("POST", "/api/v1/admin"); + MockHttpServletResponse response = new MockHttpServletResponse(); + + handler.handle(request, response, new AccessDeniedException("internal authorization detail")); + + JsonNode body = objectMapper.readTree(response.getContentAsByteArray()); + assertThat(body.path("msg").asText()).isEqualTo("Forbidden"); + assertThat(response.getContentAsString()).doesNotContain("internal authorization detail"); + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenAccessDeniedException.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenAccessDeniedException.java new file mode 100644 index 00000000..62646a53 --- /dev/null +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenAccessDeniedException.java @@ -0,0 +1,42 @@ +package com.iflytek.skillhub.auth.token; + +import org.springframework.security.access.AccessDeniedException; + +/** + * Marks an API-token authorization failure whose structured reason is safe to expose to clients. + */ +public final class ApiTokenAccessDeniedException extends AccessDeniedException { + + private final String messageCode; + private final Object[] messageArgs; + + private ApiTokenAccessDeniedException(String logMessage, String messageCode, Object... messageArgs) { + super(logMessage); + this.messageCode = messageCode; + this.messageArgs = messageArgs.clone(); + } + + static ApiTokenAccessDeniedException missingScope(String requiredScope) { + return new ApiTokenAccessDeniedException( + "Missing API token scope: " + requiredScope, + "error.apiToken.scope.missing", + requiredScope + ); + } + + static ApiTokenAccessDeniedException unsupportedEndpoint(String path) { + return new ApiTokenAccessDeniedException( + "API token cannot access endpoint: " + path, + "error.apiToken.endpoint.unsupported", + path + ); + } + + public String getMessageCode() { + return messageCode; + } + + public Object[] getMessageArgs() { + return messageArgs.clone(); + } +} diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilter.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilter.java index 97145f5d..5182ce7f 100644 --- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilter.java +++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilter.java @@ -5,7 +5,6 @@ import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; -import org.springframework.security.access.AccessDeniedException; import org.springframework.security.core.Authentication; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.context.SecurityContextHolder; @@ -59,11 +58,10 @@ public class ApiTokenScopeFilter extends OncePerRequestFilter { return; } - accessDeniedHandler.handle( - request, - response, - new AccessDeniedException(decision.message()) - ); + ApiTokenAccessDeniedException exception = decision.requiredScope() != null + ? ApiTokenAccessDeniedException.missingScope(decision.requiredScope()) + : ApiTokenAccessDeniedException.unsupportedEndpoint(request.getRequestURI()); + accessDeniedHandler.handle(request, response, exception); } @Override diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilterTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilterTest.java index 788e0291..085016f4 100644 --- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilterTest.java +++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/token/ApiTokenScopeFilterTest.java @@ -17,8 +17,10 @@ import org.springframework.security.web.access.AccessDeniedHandler; import java.util.List; import java.util.Set; +import java.util.concurrent.atomic.AtomicReference; import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertInstanceOf; import static org.junit.jupiter.api.Assertions.assertTrue; import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.eq; @@ -38,7 +40,9 @@ class ApiTokenScopeFilterTest { @Test void shouldDenyApiTokenWithoutRequiredScope() throws Exception { + AtomicReference deniedException = new AtomicReference<>(); AccessDeniedHandler handler = (request, response, accessDeniedException) -> { + deniedException.set(accessDeniedException); response.sendError(HttpServletResponse.SC_FORBIDDEN, accessDeniedException.getMessage()); }; ApiTokenScopeFilter filter = new ApiTokenScopeFilter(scopeService, handler); @@ -69,6 +73,12 @@ class ApiTokenScopeFilterTest { assertEquals(HttpServletResponse.SC_FORBIDDEN, response.getStatus()); assertTrue(response.getErrorMessage().contains("Missing API token scope: skill:publish")); + ApiTokenAccessDeniedException exception = assertInstanceOf( + ApiTokenAccessDeniedException.class, + deniedException.get() + ); + assertEquals("error.apiToken.scope.missing", exception.getMessageCode()); + assertEquals("skill:publish", exception.getMessageArgs()[0]); verify(chain, never()).doFilter(request, response); }