diff --git a/src/middleware/authz.ts b/src/middleware/authz.ts index bd97cca99..eba4c8a9a 100644 --- a/src/middleware/authz.ts +++ b/src/middleware/authz.ts @@ -4,6 +4,7 @@ import { RequestHandler } from 'express' import { find } from 'lodash' import get from 'lodash/get' import Authz, { getTeamSelfServiceAuthz } from 'src/authz' +import { HttpError } from 'src/error' import { OpenApiRequestExt } from 'src/otomi-models' import OtomiStack from 'src/otomi-stack' import { cleanEnv } from 'src/validators' @@ -61,12 +62,8 @@ export function authorize(req: OpenApiRequestExt, res, next, authz: Authz, repoS else valid = authz.validateWithCasl(action, schemaName, teamId) const env = cleanEnv({}) // TODO: Debug purpose only for removal of license - if (!env.isDev) { - if (!valid) { - return res - .status(403) - .send({ authz: false, message: `User not allowed to perform "${action}" on "${schemaName}" resource` }) - } + if (!env.isDev && !valid) { + throw new HttpError(403, `User not allowed to perform "${action}" on "${schemaName}" resource`) } const schemaToRepoMap: Record = {