From 600d763d184820e48e6e8156ee5fb7fe5e19235d Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Wed, 24 Dec 2025 10:38:24 +0100
Subject: [PATCH] Add error when unauthorized

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/server/api/connect/v1/v1_resolver.go | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index 11e29db17..b5f13d9d6 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
@@ -146,8 +147,26 @@ func (r *identityResolver) Permission(ctx context.Context, obj *types.Identity,
 			Action:    action,
 		},
 	)
+
 	if err != nil {
-		return false, nil
+		var errInsufficientPermissions *iam.ErrInsufficientPermissions
+		if errors.As(err, &errInsufficientPermissions) {
+			graphql.AddError(
+				ctx,
+				&gqlerror.Error{
+					Path:    graphql.GetPath(ctx),
+					Message: err.Error(),
+					Extensions: map[string]interface{}{
+						"code": "UNAUTHORIZED",
+					},
+				},
+			)
+
+			return false, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot authorize", log.Error(err))
+		return false, gqlutils.InternalServerError(ctx)
 	}
 
 	return true, nil