Show proper error on 409 due to auth error

Author: diocas

packages/web-runtime/src/pages/accessDenied.vue

@@ -51,6 +51,7 @@ export default defineComponent({
     const { currentTheme } = storeToRefs(themeStore)
     const configStore = useConfigStore()
     const redirectUrlQuery = useRouteQuery('redirectUrl')
+    const reasonQuery = useRouteQuery('reason')
 
     const { $gettext } = useGettext()
 
@@ -62,6 +63,11 @@ export default defineComponent({
       return $gettext('Not logged in')
     })
     const cardHint = computed(() => {
+      if (queryItemAsString(unref(reasonQuery)) === 'lowAssuranceLevel') {
+        return $gettext(
+          'Please login to your CERN account using the CERN credentials instead of a guest account.'
+        )
+      }
       return $gettext(
         'This could be because of a routine safety log out, or because your account is either inactive or not yet authorized for use. Please try logging in after a while or seek help from your Administrator.'
       )

packages/web-runtime/src/router/setupAuthGuard.ts

@@ -47,6 +47,9 @@ export const setupAuthGuard = (router: Router) => {
 
     if (isUserContextRequired(router, to)) {
       if (!authStore.userContextReady) {
+        if (authService.lowAssuranceError) {
+          return { name: 'accessDenied', query: { reason: 'lowAssuranceLevel' } }
+        }
         if (unref(isDelegatingAuthentication)) {
           return { path: '/web-oidc-callback' }
         }

packages/web-runtime/src/services/auth/authService.ts

@@ -1,3 +1,4 @@
+import { ErrorResponse } from 'oidc-client-ts'
 import { UserManager } from './userManager'
 import { PublicLinkManager } from './publicLinkManager'
 import {
@@ -44,6 +45,7 @@ export class AuthService implements AuthServiceInterface {
   private accessTokenExpiryThreshold = 10
 
   public hasAuthErrorOccurred: boolean
+  public lowAssuranceError: boolean
 
   public initialize(
     configStore: ConfigStore,
@@ -60,6 +62,7 @@ export class AuthService implements AuthServiceInterface {
     this.clientService = clientService
     this.router = router
     this.hasAuthErrorOccurred = false
+    this.lowAssuranceError = false
     this.ability = ability
     this.language = language
     this.userStore = userStore
@@ -165,6 +168,10 @@ export class AuthService implements AuthServiceInterface {
           try {
             await this.userManager.updateContext(user.access_token, fetchUserData)
           } catch (e) {
+            if (this.isLowAssuranceLevelError(e)) {
+              this.lowAssuranceError = true
+              return
+            }
             console.error(e)
             await this.handleAuthError(unref(this.router.currentRoute))
           }
@@ -227,6 +234,10 @@ export class AuthService implements AuthServiceInterface {
             this.tokenTimerInitialized = true
           }
         } catch (e) {
+          if (this.isLowAssuranceLevelError(e)) {
+            this.lowAssuranceError = true
+            return
+          }
           console.error(e)
           await this.handleAuthError(unref(this.router.currentRoute))
         }
@@ -269,6 +280,10 @@ export class AuthService implements AuthServiceInterface {
         ...(redirectRoute.query && { query: redirectRoute.query })
       })
     } catch (e) {
+      if (this.isLowAssuranceLevelError(e)) {
+        this.lowAssuranceError = true
+        return this.router.push({ name: 'accessDenied', query: { reason: 'lowAssuranceLevel' } })
+      }
       console.warn('error during authentication:', e)
       return this.handleAuthError(unref(this.router.currentRoute))
     }
@@ -329,6 +344,10 @@ export class AuthService implements AuthServiceInterface {
     this.hasAuthErrorOccurred = true
   }
 
+  private isLowAssuranceLevelError(e: unknown): boolean {
+    return e instanceof ErrorResponse && e.error === 'low_assurance_level'
+  }
+
   public async resolvePublicLink(
     token: string,
     passwordRequired: boolean,

packages/web-runtime/src/services/auth/userManager.ts

@@ -187,7 +187,15 @@ export class UserManager extends OidcUserManager {
 
   private async fetchUserInfo() {
     const graphClient = this.clientService.graphAuthenticated
-    const [graphUser, roles] = await Promise.all([graphClient.users.getMe(), this.fetchRoles()])
+    let graphUser: Awaited<ReturnType<typeof graphClient.users.getMe>>, roles: SettingsBundle[]
+    try {
+      ;[graphUser, roles] = await Promise.all([graphClient.users.getMe(), this.fetchRoles()])
+    } catch (e) {
+      if (e?.response?.status === 409) {
+        throw new ErrorResponse({ error: 'low_assurance_level' } as any)
+      }
+      throw e
+    }
     const role = await this.fetchRole({ graphUser, roles })
 
     this.userStore.setUser({
@@ -307,6 +315,9 @@ export class UserManager extends OidcUserManager {
       user.access_token = revaToken
       user.expires_at = claims.exp
     } catch (e) {
+      if (e?.response?.status === 409) {
+        throw new ErrorResponse({ ...signinResponse, error: 'low_assurance_level' })
+      }
       console.error('Failed to get reva token, continue with sso one', e)
     }
     // end