[service-utils] Improve 403 error messages with team and project details #7114
Conversation
🦋 Changeset detectedLatest commit: 60037fb The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WalkthroughThe changes introduce more descriptive error messages in the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant authorizeService
participant Team/Project Data
Client->>authorizeService: Request authorization
authorizeService->>Team/Project Data: Retrieve team/project info
Team/Project Data-->>authorizeService: Return team/project info
alt Unauthorized for team
authorizeService-->>Client: Return error with team name and ID
else Unauthorized for project
authorizeService-->>Client: Return error with project name and publishable key
else Unauthorized action for project
authorizeService-->>Client: Return error with project name and publishable key
else Authorized
authorizeService-->>Client: Grant access
end
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 30th. To opt out, configure Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (2)
⏰ Context from checks skipped due to timeout of 90000ms (8)
🔇 Additional comments (2)
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
How to use the Graphite Merge QueueAdd either label to this PR to merge it via the merge queue:
You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
packages/service-utils/src/core/authorize/service.ts (1)
59-59: Fix extra spacing before URL
There's an accidental double space before the URL in the action-unauthorized message. It should be a single space.
Apply this diff:- ... dashboard: https://thirdweb.com/create-api-key + ... dashboard: https://thirdweb.com/create-api-key.changeset/blue-mice-prove.md (1)
1-5: Enhance changeset summary specificity
The summary “Better error messages for 403 responses” is correct but could include key details for clearer release notes. For example:Include team name/ID and project name/publishable key in 403 Forbidden error messages
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.changeset/blue-mice-prove.md(1 hunks)packages/service-utils/src/core/authorize/service.ts(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (7)
- GitHub Check: E2E Tests (pnpm, esbuild)
- GitHub Check: Size
- GitHub Check: E2E Tests (pnpm, webpack)
- GitHub Check: E2E Tests (pnpm, vite)
- GitHub Check: Lint Packages
- GitHub Check: Build Packages
- GitHub Check: Analyze (javascript)
🔇 Additional comments (2)
packages/service-utils/src/core/authorize/service.ts (2)
22-22: Confirm PII exposure for team context
Includingteam.nameandteam.idin the client-facing error message may expose internal identifiers. Please verify that this aligns with our PII/security policy and is safe to expose in logs or to end users.
45-45: Confirm PII exposure for project context
The error message now includesproject.nameandproject.publishableKey. Ensure that surfacing the publishable key and project name in a 403 error does not violate any security guidelines or leak sensitive details.
size-limit report 📦
|
joaquim-verges
force-pushed
the
_service-utils_Improve_403_error_messages_with_team_and_project_details
branch
from
9db36d3 to
60037fb
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #7114 +/- ##
=======================================
Coverage 55.60% 55.60%
=======================================
Files 901 901
Lines 58121 58121
Branches 4067 4067
=======================================
Hits 32320 32320
Misses 25696 25696
Partials 105 105
🚀 New features to boost your workflow:
|
joaquim-verges
deleted the
_service-utils_Improve_403_error_messages_with_team_and_project_details
branch
PR-Codex overview
This PR focuses on improving error messages for 403 responses in the
service-utilspackage, providing more context in the messages related to unauthorized services and actions.Detailed summary
service.test.tsto usetoContainfor better matching.service.tsto include team and project details for unauthorized service and action responses.Summary by CodeRabbit