Improve unauthorized error messages.

3 files changed, 72 insertions, 39 deletions

diff --git a/common/changes/feature_4035_improve-error-messages b/common/changes/feature_4035_improve-error-messages
new file mode 100644
index 00000000..4f86a17f
--- /dev/null
+++ b/common/changes/feature_4035_improve-error-messages
@@ -0,0 +1,3 @@
+  o Improve error messages. Closes #5035.
+      * Add MissingTokenError and InvalidTokenError as sub exceptions from
+        Unauthorized.
diff --git a/common/src/leap/soledad/common/errors.py b/common/src/leap/soledad/common/errors.py
index fc4d106a..446c4c75 100644
--- a/common/src/leap/soledad/common/errors.py
+++ b/common/src/leap/soledad/common/errors.py
@@ -25,14 +25,17 @@ from u1db import errors
 from u1db.remote import http_errors
 
 
-exceptions = []
-
-
 def register_exception(cls):
     """
-    A small decorator to make it easier to register exceptions.
+    A small decorator that registers exceptions in u1db maps.
     """
-    exceptions.append(cls)
+    # update u1db "wire description to status" and "wire description to
+    # exception" maps.
+    http_errors.wire_description_to_status.update({
+        cls.wire_description: cls.status})
+    errors.wire_description_to_exc.update({
+        cls.wire_description: cls})
+    # do not modify the exception
     return cls
 
 
@@ -44,6 +47,30 @@ class SoledadError(errors.U1DBError):
 
 
 #
+# Authorization errors
+#
+
+@register_exception
+class MissingAuthTokenError(errors.Unauthorized):
+    """
+    Exception raised when failing to get authorization for some action because
+    the auth token is missing in the tokens db.
+    """
+
+    wire_description = "missing token"
+    status = 401
+
+@register_exception
+class InvalidAuthTokenError(errors.Unauthorized):
+    """
+    Exception raised when failing to get authorization for some action because
+    the provided token is different from the one in the tokens db.
+    """
+
+    wire_descrition = "token mismatch"
+    status = 401
+
+#
 # LockResource errors
 #
 
@@ -156,15 +183,6 @@ class DesignDocUnknownError(SoledadError):
     status = 500
 
 
-# update u1db "wire description to status" and "wire description to exception"
-# maps.
-for e in exceptions:
-    http_errors.wire_description_to_status.update({
-        e.wire_description: e.status})
-    errors.wire_description_to_exc.update({
-        e.wire_description: e})
-
-
 # u1db error statuses also have to be updated
 http_errors.ERROR_STATUSES = set(
     http_errors.wire_description_to_status.values())
diff --git a/server/src/leap/soledad/server/auth.py b/server/src/leap/soledad/server/auth.py
index 0ae49576..11805005 100644
--- a/server/src/leap/soledad/server/auth.py
+++ b/server/src/leap/soledad/server/auth.py
@@ -36,19 +36,10 @@ from leap.soledad.common import (
     SHARED_DB_NAME,
     SHARED_DB_LOCK_DOC_ID_PREFIX,
     USER_DB_PREFIX,
+    errors,
 )
 
 
-#-----------------------------------------------------------------------------
-# Authentication
-#-----------------------------------------------------------------------------
-
-class Unauthorized(Exception):
-    """
-    User authentication failed.
-    """
-
-
 class URLToAuthorization(object):
     """
     Verify if actions can be performed by a user.
@@ -279,10 +270,16 @@ class SoledadAuthMiddleware(object):
             return self._unauthorized_error("Wrong authentication scheme")
 
         # verify if user is athenticated
-        if not self._verify_authentication_data(uuid, auth_data):
-            return self._unauthorized_error(
+        try:
+            if not self._verify_authentication_data(uuid, auth_data):
+                return self._unauthorized_error(
+                    start_response,
+                    self._get_auth_error_string())
+        except Unauthorized as e:
+            return self._error(
                 start_response,
-                self._get_auth_error_string())
+                401,
+                e.wire_description)
 
         # verify if user is authorized to perform action
         if not self._verify_authorization(environ, uuid):
@@ -319,6 +316,9 @@ class SoledadAuthMiddleware(object):
 
         @return: Whether the token is valid for authenticating the request.
         @rtype: bool
+
+        @raise Unauthorized: Raised when C{auth_data} is not enough to
+                             authenticate C{uuid}.
         """
         return None
 
@@ -386,9 +386,20 @@ class SoledadTokenAuthMiddleware(SoledadAuthMiddleware):
 
         @return: Whether the token is valid for authenticating the request.
         @rtype: bool
+
+        @raise Unauthorized: Raised when C{auth_data} is not enough to
+                             authenticate C{uuid}.
         """
         token = auth_data  # we expect a cleartext token at this point
-        return self._verify_token_in_couchdb(uuid, token)
+        try:
+            return self._verify_token_in_couchdb(uuid, token)
+        except MissingAuthTokenError():
+            raise
+        except TokenMismatchError():
+            raise
+        except Exception as e:
+            log.err(e)
+            return False
 
     def _verify_token_in_couchdb(self, uuid, token):
         """
@@ -398,19 +409,20 @@ class SoledadTokenAuthMiddleware(SoledadAuthMiddleware):
         @type uuid: str
         @param token: The token.
         @type token: str
+
+        @raise MissingAuthTokenError: Raised when given token is missing in
+                                      tokens db.
+        @raise InvalidAuthTokenError: Raised when token is invalid.
         """
         server = Server(url=self._app.state.couch_url)
-        try:
-            dbname = self.TOKENS_DB
-            db = server[dbname]
-            token = db.get(token)
-            if token is None:
-                return False
-            return token[self.TOKENS_TYPE_KEY] == self.TOKENS_TYPE_DEF and \
-                token[self.TOKENS_USER_ID_KEY] == uuid
-        except Exception as e:
-            log.err(e)
-            return False
+        dbname = self.TOKENS_DB
+        db = server[dbname]
+        token = db.get(token)
+        if token is None:
+            raise MissingAuthTokenError()
+        if token[self.TOKENS_TYPE_KEY] != self.TOKENS_TYPE_DEF or \
+                token[self.TOKENS_USER_ID_KEY] != uuid:
+            raise InvalidAuthTokenError()
         return True
 
     def _get_auth_error_string(self):