From cb993f9dc80b05f662f99bf635d092c2f6387c5d Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Mon, 19 Feb 2024 16:25:59 +0100
Subject: [PATCH] backend-app-api: treat rejected none credentials as 401
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .../implementations/httpAuth/httpAuthServiceFactory.ts |  3 +++
 .../src/next/services/MockHttpAuthService.test.ts      |  3 ++-
 .../src/next/services/MockHttpAuthService.ts           | 10 ++++++----
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
index 393991c6d0..44199f4256 100644
--- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
+++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
@@ -124,6 +124,9 @@ class DefaultHttpAuthService implements HttpAuthService {
       allowedPrincipalTypes &&
       !allowedPrincipalTypes.includes(credentials.principal.type as TAllowed)
     ) {
+      if (credentials.authMethod === 'none') {
+        throw new AuthenticationError();
+      }
       throw new NotAllowedError(
         `This endpoint does not allow '${credentials.principal.type}' credentials`,
       );
diff --git a/packages/backend-test-utils/src/next/services/MockHttpAuthService.test.ts b/packages/backend-test-utils/src/next/services/MockHttpAuthService.test.ts
index 6f21c709f7..922b3daaf4 100644
--- a/packages/backend-test-utils/src/next/services/MockHttpAuthService.test.ts
+++ b/packages/backend-test-utils/src/next/services/MockHttpAuthService.test.ts
@@ -17,6 +17,7 @@
 import { Request } from 'express';
 import { MockHttpAuthService } from './MockHttpAuthService';
 import { mockCredentials } from './mockCredentials';
+import { AuthenticationError } from '@backstage/errors';
 
 describe('MockHttpAuthService', () => {
   const httpAuth = new MockHttpAuthService('test', mockCredentials.none());
@@ -36,7 +37,7 @@ describe('MockHttpAuthService', () => {
 
     await expect(
       httpAuth.credentials(makeAuthReq(), { allow: ['user'] }),
-    ).rejects.toThrow("This endpoint does not allow 'none' credentials");
+    ).rejects.toThrow(AuthenticationError);
 
     await expect(httpAuth.credentials(makeAuthReq())).resolves.toEqual(
       mockCredentials.none(),
diff --git a/packages/backend-test-utils/src/next/services/MockHttpAuthService.ts b/packages/backend-test-utils/src/next/services/MockHttpAuthService.ts
index 79a940789a..2f067e9dcb 100644
--- a/packages/backend-test-utils/src/next/services/MockHttpAuthService.ts
+++ b/packages/backend-test-utils/src/next/services/MockHttpAuthService.ts
@@ -22,7 +22,11 @@ import {
 } from '@backstage/backend-plugin-api';
 import { Request, Response } from 'express';
 import { MockAuthService } from './MockAuthService';
-import { NotAllowedError, NotImplementedError } from '@backstage/errors';
+import {
+  AuthenticationError,
+  NotAllowedError,
+  NotImplementedError,
+} from '@backstage/errors';
 import { mockCredentials } from './mockCredentials';
 
 // TODO: support mock cookie auth?
@@ -73,9 +77,7 @@ export class MockHttpAuthService implements HttpAuthService {
         return credentials as any;
       }
 
-      throw new NotAllowedError(
-        `This endpoint does not allow 'none' credentials`,
-      );
+      throw new AuthenticationError();
     } else if (this.#auth.isPrincipal(credentials, 'user')) {
       if (allowedPrincipalTypes.includes('user' as TAllowed)) {
         return credentials as any;