Bug: 500 server error when creating a policy

[ShaunBaker]

The following request:

curl 'http://localhost:8810/authorization/policies?sig=serviceKey' -H 'Pragma: no-cache' -H 'Origin: http://localhost:3001' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,ru;q=0.7' -H 'Content-Type: application/json;charset=UTF-8' -H 'Accept: application/json, text/plain, */*' -H 'Cache-Control: no-cache' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36' -H 'Connection: keep-alive' -H 'Referer: http://localhost:3001/policies' --data-binary '{"name":"Test Policy 1","version":"1","statements":{"Statement":[{"Effect":"string","Action":["string"],"Resource":["string"],"Sid":"string","Condition":{}}]}}' --compressed

Produces the following response:

{"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred"}

Internally the logs are showing:

Debug: internal, implementation, error
    Error: child "PolicyStatements" fails because [child "Statement" fails because ["Statement" at position 0 fails because [child "Effect" fails because ["Effect" must be one of [Allow, Deny]]]]]
    at postValidate (/app/node_modules/hapi/lib/validation.js:212:30)
    at internals.Object._validateWithOptions (/app/node_modules/udaru/node_modules/joi/lib/types/any/index.js:654:20)
    at module.exports.internals.Any.root.validate (/app/node_modules/hapi/node_modules/joi/lib/index.js:139:23)
    at exports.response (/app/node_modules/hapi/lib/validation.js:242:20)
    at each (/app/node_modules/hapi/lib/request.js:401:16)
    at iterate (/app/node_modules/items/lib/index.js:36:13)
    at done (/app/node_modules/items/lib/index.js:28:25)
    at Hoek.once (/app/node_modules/hapi/lib/protect.js:50:16)
    at wrapped (/app/node_modules/hoek/lib/index.js:879:20)
    at done (/app/node_modules/items/lib/index.js:31:25)
    at finalize (/app/node_modules/hapi/lib/request.js:446:24)
    at Function.wrapped (/app/node_modules/hoek/lib/index.js:879:20)
    at Function.internals.continue (/app/node_modules/hapi/lib/reply.js:139:10)
    at bound (domain.js:303:14)
    at Function.runBound [as continue] (domain.js:314:12)
    at plugin.ext (/app/node_modules/hapi-swagger/lib/index.js:290:30)
    at each (/app/node_modules/hapi/lib/request.js:453:22)
    at iterate (/app/node_modules/items/lib/index.js:36:13)
    at Object.exports.serial (/app/node_modules/items/lib/index.js:39:9)
    at _protect.run (/app/node_modules/hapi/lib/request.js:456:15)
    at module.exports.internals.Protect.internals.Protect.run (/app/node_modules/hapi/lib/protect.js:60:12)
    at internals.Request._invoke (/app/node_modules/hapi/lib/request.js:436:19)

This should not be a 500 error - but a 400 Bad Request which communicates the error.

[ShaunBaker]

As a followup to this - the policy has been saved - which is then causing the /authorization/policies endpoint to error with a 500:

Debug: internal, implementation, error
    Error: child "Data" fails because ["Data" at position 11 fails because [child "PolicyStatements" fails because [child "Statement" fails because ["Statement" at position 0 fails because [child "Effect" fails because ["Effect" must be one of [Allow, Deny]]]]]]]
    at postValidate (/app/node_modules/hapi/lib/validation.js:212:30)
    at internals.Object._validateWithOptions (/app/node_modules/udaru/node_modules/joi/lib/types/any/index.js:654:20)
    at module.exports.internals.Any.root.validate (/app/node_modules/hapi/node_modules/joi/lib/index.js:139:23)
    at exports.response (/app/node_modules/hapi/lib/validation.js:242:20)
    at each (/app/node_modules/hapi/lib/request.js:401:16)
    at iterate (/app/node_modules/items/lib/index.js:36:13)
    at done (/app/node_modules/items/lib/index.js:28:25)
    at Hoek.once (/app/node_modules/hapi/lib/protect.js:50:16)
    at wrapped (/app/node_modules/hoek/lib/index.js:879:20)
    at done (/app/node_modules/items/lib/index.js:31:25)
    at finalize (/app/node_modules/hapi/lib/request.js:446:24)
    at Function.wrapped (/app/node_modules/hoek/lib/index.js:879:20)
    at Function.internals.continue (/app/node_modules/hapi/lib/reply.js:139:10)
    at bound (domain.js:303:14)
    at Function.runBound [as continue] (domain.js:314:12)
    at plugin.ext (/app/node_modules/hapi-swagger/lib/index.js:290:30)
    at each (/app/node_modules/hapi/lib/request.js:453:22)
    at iterate (/app/node_modules/items/lib/index.js:36:13)
    at Object.exports.serial (/app/node_modules/items/lib/index.js:39:9)
    at _protect.run (/app/node_modules/hapi/lib/request.js:456:15)
    at module.exports.internals.Protect.internals.Protect.run (/app/node_modules/hapi/lib/protect.js:60:12)
    at internals.Request._invoke (/app/node_modules/hapi/lib/request.js:436:19)

[cianfoley-nearform]

Hi Shaun,

I found this bug, essentially our Joi statement object isn't limiting effect to allow|deny on input, however it is on output rule...

The error occurred on response validation, which does have the limitation, both the post and the get perform validation on the response and that's why the error is showing in both situations above...

Once the validation rule is in, this will become a 400 error.

[cianfoley-nearform]

I'm currently updating all of our Joi validation objects with labels so the swagger doc becomes more consistent so I'll check this in with the rest of those fixes today

[cianfoley-nearform]

here is the output after retesting with rules in place...

{
"statusCode": 400,
"error": "Bad Request",
"message": "child "StatementsObject" fails because [child "StatementsArray" fails because ["StatementsArray" at position 0 fails because [child "Effect" fails because ["Effect" must be one of [Allow, Deny]]]]]",
"validation": {
"source": "payload",
"keys": [
"statements.Statement.0.Effect"
]
}
}

[cianfoley-nearform]

Fixed in this commit: 534787f

Will be included in next release...