fix(auth): return 403 instead of 404 in has_permission decorator#1326
fix(auth): return 403 instead of 404 in has_permission decorator#1326dipak0000812 wants to merge 2 commits intoDalgoT4D:mainfrom
Conversation
Remove bare except block that incorrectly converts authorization failures into 404 responses. Ensure proper 403 response and avoid masking unexpected errors. Fixes DalgoT4D#1325 Signed-off-by: Dipak <dhangardip09@gmail.com>
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 59 minutes and 21 seconds.Comment |
1 participant
Summary
Fix incorrect error handling in
has_permissiondecorator.The current implementation uses a bare
except:block that catchesHttpError(403)and re-raises it asHttpError(404), causing permission-denied responses to incorrectly return 404 instead of 403.Changes
exceptblockrequest.permissions403statusWhy
Returning 404 for authorization failures violates HTTP semantics and makes debugging harder. This change ensures accurate status codes and avoids masking real issues.
Impact
Fixes #1325