question: authorizationChecker throws Error: at AuthorizationRequiredError.HttpError [as constructor]

I try to implement an authorizationChecker, but it throw the following error when it return false

Error: at AuthorizationRequiredError.HttpError [as constructor] (/src/http-error/HttpError.ts:19:22) at AuthorizationRequiredError.UnauthorizedError [as constructor] (/src/http-error/UnauthorizedError.ts:10:9) at new AuthorizationRequiredError (/src/error/AuthorizationRequiredError.ts:12:9) at handleError_1 (/src/driver/express/ExpressDriver.ts:111:87) at /src/driver/express/ExpressDriver.ts:120:45 at process._tickCallback (internal/process/next_tick.js:68:7)

I reproduce this bug with minimal configuration:

// index.ts
import "reflect-metadata";
import { createExpressServer, Action } from "routing-controllers";
import { DemoController } from "./controllers/DemoController";

createExpressServer({
  controllers: [DemoController],
  authorizationChecker: async (action: Action, roles: string[]) => {
    return false;
  }
}).listen(3000);

// controllers/DemoController.ts
import { Controller, Get, Authorized } from "routing-controllers";
@Controller("/")
export class DemoController {
  @Authorized()
  @Get("/")
  getDemo() {
    return { demo: "this is a demo" };
  }
}

Here is a codesandbox with this issue: https://codesandbox.io/s/routing-controllers-bug-ovdwt?file=/src/index.ts

What am I doing wrong ?

[jotamorais]

@zecka, routing-controllers will do that out-of-the-box for you. If you want to handle the messages in a central place, you can disable the defaultErrorHandler and configure a specific middleware for error handling, that way, any of the built-ins exceptions such as

• HttpError
• BadRequestError
• ForbiddenError
• InternalServerError
• MethodNotAllowedError
• NotAcceptableError
• NotFoundError
• UnauthorizedError

will always output the format you want:

index.ts

import "reflect-metadata";
import {
  createExpressServer,
  Action,
  UnauthorizedError
} from "routing-controllers";
import { DemoController } from "./controllers/DemoController";
import { ErrorHandler } from "./middlewares/ErrorHandler";

createExpressServer({
  development: false,
  defaultErrorHandler: false,
  middlewares: [ErrorHandler],
  controllers: [DemoController],
  authorizationChecker: async (action: Action, roles: string[]) => {
    throw new UnauthorizedError("You're not authorized");
    // return false;
  }
}).listen(3000);

middlewares/ErrorHandler.ts

import {
  Middleware,
  ExpressErrorMiddlewareInterface
} from "routing-controllers";

@Middleware({ type: "after" })
export class ErrorHandler implements ExpressErrorMiddlewareInterface {
  public error(
    error: any,
    request: any,
    response: any,
    next: (err: any) => any
  ) {
    if (response.headersSent) {
      return;
    }

    response.json(error);
  }
}

controllers/DemoController.ts

import { Controller, Get, Authorized } from "routing-controllers";
@Controller("/")
export class DemoController {
  @Authorized()
  @Get("/")
  getDemo() {
    return { demo: "this is a demo" };
  }
}

Will automatically produce something like:

{"httpCode":401,"name":"UnauthorizedError","message":"You're not authorized"}

Check in the sandbox: https://codesandbox.io/s/routing-controllers-authorizationchecker-559-3ekl0

[NoNameProvided]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.