Manage errors

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/authz/service.go

@@ -29,6 +29,14 @@ import (
 	"go.gearno.de/kit/pg"
 )
 
+type TenantAccessError struct {
+	Message string
+}
+
+func (e *TenantAccessError) Error() string {
+	return "not authorized"
+}
+
 type (
 	Service struct {
 		pg                      *pg.Client

pkg/coredata/asset.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -42,8 +43,24 @@ type (
 	}
 
 	Assets []*Asset
+
+	ErrAssetNotFound struct {
+		Identifier string
+	}
+
+	ErrAssetAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrAssetNotFound) Error() string {
+	return fmt.Sprintf("asset not found: %q", e.Identifier)
+}
+
+func (e ErrAssetAlreadyExists) Error() string {
+	return e.message
+}
+
 func (a *Asset) CursorKey(field AssetOrderField) page.CursorKey {
 	switch field {
 	case AssetOrderFieldCreatedAt:
@@ -94,6 +111,10 @@ LIMIT 1;
 
 	asset, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Asset])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAssetNotFound{Identifier: assetID.String()}
+		}
+
 		return fmt.Errorf("cannot collect asset: %w", err)
 	}
 
@@ -140,6 +161,10 @@ LIMIT 1;
 
 	asset, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Asset])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAssetNotFound{Identifier: a.OwnerID.String()}
+		}
+
 		return fmt.Errorf("cannot collect asset: %w", err)
 	}
 

pkg/coredata/audit.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -42,8 +43,24 @@ type (
 	}
 
 	Audits []*Audit
+
+	ErrAuditNotFound struct {
+		Identifier string
+	}
+
+	ErrAuditAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrAuditNotFound) Error() string {
+	return fmt.Sprintf("audit not found: %q", e.Identifier)
+}
+
+func (e ErrAuditAlreadyExists) Error() string {
+	return e.message
+}
+
 func (a *Audit) CursorKey(field AuditOrderField) page.CursorKey {
 	switch field {
 	case AuditOrderFieldCreatedAt:
@@ -98,6 +115,10 @@ LIMIT 1;
 
 	audit, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Audit])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAuditNotFound{Identifier: auditID.String()}
+		}
+
 		return fmt.Errorf("cannot collect audit: %w", err)
 	}
 
@@ -508,6 +529,10 @@ LIMIT 1;
 
 	audit, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Audit])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrAuditNotFound{Identifier: reportID.String()}
+		}
+
 		return fmt.Errorf("cannot collect audit: %w", err)
 	}
 

pkg/coredata/control.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -48,8 +50,24 @@ type (
 		Status                 *ControlStatus
 		ExclusionJustification *string
 	}
+
+	ErrControlNotFound struct {
+		Identifier string
+	}
+
+	ErrControlAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrControlNotFound) Error() string {
+	return fmt.Sprintf("control not found: %q", e.Identifier)
+}
+
+func (e ErrControlAlreadyExists) Error() string {
+	return e.message
+}
+
 func (c Control) CursorKey(orderBy ControlOrderField) page.CursorKey {
 	switch orderBy {
 	case ControlOrderFieldCreatedAt:
@@ -628,6 +646,10 @@ LIMIT 1;
 
 	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrControlNotFound{Identifier: fmt.Sprintf("%s:%s", frameworkID, sectionTitle)}
+		}
+
 		return fmt.Errorf("cannot collect control: %w", err)
 	}
 
@@ -671,6 +693,10 @@ LIMIT 1;
 
 	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrControlNotFound{Identifier: controlID.String()}
+		}
+
 		return fmt.Errorf("cannot collect control: %w", err)
 	}
 
@@ -725,7 +751,20 @@ VALUES (
 		"updated_at":              c.UpdatedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "controls_framework_ref_unique" {
+				return &ErrControlAlreadyExists{
+					message: fmt.Sprintf("control with framework_id %s and section_title %q already exists", c.FrameworkID, c.SectionTitle),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert control: %w", err)
+	}
+
+	return nil
 }
 
 func (c Control) Delete(
@@ -810,6 +849,18 @@ RETURNING
 
 	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Control])
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "controls_framework_ref_unique" {
+				sectionTitle := ""
+				if params.SectionTitle != nil {
+					sectionTitle = *params.SectionTitle
+				}
+				return &ErrControlAlreadyExists{
+					message: fmt.Sprintf("control with section_title %q already exists", sectionTitle),
+				}
+			}
+		}
 		return fmt.Errorf("cannot collect control: %w", err)
 	}
 

pkg/coredata/custom_domain.go

@@ -17,6 +17,7 @@ package coredata
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -25,6 +26,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -49,8 +51,24 @@ type (
 	}
 
 	CustomDomains []*CustomDomain
+
+	ErrCustomDomainNotFound struct {
+		Identifier string
+	}
+
+	ErrCustomDomainAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrCustomDomainNotFound) Error() string {
+	return fmt.Sprintf("custom domain not found: %q", e.Identifier)
+}
+
+func (e ErrCustomDomainAlreadyExists) Error() string {
+	return e.message
+}
+
 func NewCustomDomain(tenantID gid.TenantID, domain string) *CustomDomain {
 	now := time.Now()
 	return &CustomDomain{
@@ -357,6 +375,14 @@ INSERT INTO custom_domains (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "custom_domains_domain_key" {
+				return &ErrCustomDomainAlreadyExists{
+					message: fmt.Sprintf("custom domain with domain %q already exists", cd.Domain),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert custom domain: %w", err)
 	}
 

pkg/coredata/document.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -41,8 +42,24 @@ type (
 	}
 
 	Documents []*Document
+
+	ErrDocumentNotFound struct {
+		Identifier string
+	}
+
+	ErrDocumentAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrDocumentNotFound) Error() string {
+	return fmt.Sprintf("document not found: %q", e.Identifier)
+}
+
+func (e ErrDocumentAlreadyExists) Error() string {
+	return e.message
+}
+
 func (p Document) CursorKey(orderBy DocumentOrderField) page.CursorKey {
 	switch orderBy {
 	case DocumentOrderFieldCreatedAt:
@@ -95,6 +112,10 @@ LIMIT 1;
 
 	document, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Document])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrDocumentNotFound{Identifier: documentID.String()}
+		}
+
 		return fmt.Errorf("cannot collect document: %w", err)
 	}
 

pkg/coredata/document_version.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -43,8 +45,32 @@ type (
 	}
 
 	DocumentVersions []*DocumentVersion
+
+	ErrDocumentVersionNotFound struct {
+		Identifier string
+	}
+
+	ErrDocumentVersionAlreadyExists struct {
+		message string
+	}
+
+	ErrDocumentVersionNoChanges struct {
+		Message string
+	}
 )
 
+func (e ErrDocumentVersionNotFound) Error() string {
+	return fmt.Sprintf("document version not found: %q", e.Identifier)
+}
+
+func (e ErrDocumentVersionAlreadyExists) Error() string {
+	return e.message
+}
+
+func (e ErrDocumentVersionNoChanges) Error() string {
+	return e.Message
+}
+
 func (p *DocumentVersions) LoadByDocumentID(
 	ctx context.Context,
 	conn pg.Conn,
@@ -207,6 +233,21 @@ VALUES (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				if pgErr.ConstraintName == "document_versions_document_id_version_number_key" {
+					return &ErrDocumentVersionAlreadyExists{
+						message: fmt.Sprintf("document version with document_id %s and version_number %d already exists", p.DocumentID, p.VersionNumber),
+					}
+				}
+				if pgErr.ConstraintName == "document_one_draft_version_idx" {
+					return &ErrDocumentVersionAlreadyExists{
+						message: fmt.Sprintf("document %s already has a draft version", p.DocumentID),
+					}
+				}
+			}
+		}
 		return fmt.Errorf("error creating document version: %w", err)
 	}
 

pkg/coredata/document_version_signature.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -46,8 +48,24 @@ type (
 	}
 
 	DocumentVersionSignaturesWithPeople []*DocumentVersionSignatureWithPeople
+
+	ErrDocumentVersionSignatureNotFound struct {
+		Identifier string
+	}
+
+	ErrDocumentVersionSignatureAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrDocumentVersionSignatureNotFound) Error() string {
+	return fmt.Sprintf("document version signature not found: %q", e.Identifier)
+}
+
+func (e ErrDocumentVersionSignatureAlreadyExists) Error() string {
+	return e.message
+}
+
 func (pvs DocumentVersionSignature) CursorKey(orderBy DocumentVersionSignatureOrderField) page.CursorKey {
 	switch orderBy {
 	case DocumentVersionSignatureOrderFieldCreatedAt:
@@ -191,6 +209,14 @@ INSERT INTO document_version_signatures (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "policy_version_signatures_policy_version_id_signed_by_key" {
+				return &ErrDocumentVersionSignatureAlreadyExists{
+					message: fmt.Sprintf("document version signature with document_version_id %s and signed_by %s already exists", pvs.DocumentVersionID, pvs.SignedBy),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert document version signature: %w", err)
 	}
 

pkg/coredata/evidence.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -42,8 +44,24 @@ type (
 	}
 
 	Evidences []*Evidence
+
+	ErrEvidenceNotFound struct {
+		Identifier string
+	}
+
+	ErrEvidenceAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrEvidenceNotFound) Error() string {
+	return fmt.Sprintf("evidence not found: %q", e.Identifier)
+}
+
+func (e ErrEvidenceAlreadyExists) Error() string {
+	return e.message
+}
+
 func (e Evidence) CursorKey(orderBy EvidenceOrderField) page.CursorKey {
 	switch orderBy {
 	case EvidenceOrderFieldCreatedAt:
@@ -165,7 +183,20 @@ VALUES (
 		"description":      e.Description,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "evidences_reference_id_key" {
+				return &ErrEvidenceAlreadyExists{
+					message: fmt.Sprintf("evidence with task_id %s and reference_id %q already exists", e.TaskID, e.ReferenceID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert evidence: %w", err)
+	}
+
+	return nil
 }
 
 func (e *Evidence) LoadByID(

pkg/coredata/file.go

@@ -16,12 +16,14 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
 
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -39,8 +41,24 @@ type (
 	}
 
 	Files []*File
+
+	ErrFileNotFound struct {
+		Identifier string
+	}
+
+	ErrFileAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrFileNotFound) Error() string {
+	return fmt.Sprintf("file not found: %q", e.Identifier)
+}
+
+func (e ErrFileAlreadyExists) Error() string {
+	return e.message
+}
+
 func (f *File) LoadByID(
 	ctx context.Context,
 	conn pg.Conn,
@@ -79,6 +97,10 @@ LIMIT 1;
 
 	file, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[File])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrFileNotFound{Identifier: fileID.String()}
+		}
+
 		return fmt.Errorf("cannot collect file: %w", err)
 	}
 
@@ -133,7 +155,20 @@ VALUES (
 		"deleted_at":  f.DeletedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "files_file_key_key" {
+				return &ErrFileAlreadyExists{
+					message: fmt.Sprintf("file with file_key %q already exists", f.FileKey),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert file: %w", err)
+	}
+
+	return nil
 }
 
 func (f File) SoftDelete(ctx context.Context, conn pg.Conn, scope Scoper) error {

pkg/coredata/framework.go

@@ -41,12 +41,28 @@ type (
 
 	Frameworks []*Framework
 
+	ErrFrameworkNotFound struct {
+		Identifier string
+	}
+
+	ErrFrameworkAlreadyExists struct {
+		message string
+	}
+
 	ErrFrameworkReferenceIDAlreadyExists struct {
 		ReferenceID    string
 		OrganizationID gid.GID
 	}
 )
 
+func (e ErrFrameworkNotFound) Error() string {
+	return fmt.Sprintf("framework not found: %q", e.Identifier)
+}
+
+func (e ErrFrameworkAlreadyExists) Error() string {
+	return e.message
+}
+
 func (e ErrFrameworkReferenceIDAlreadyExists) Error() string {
 	return fmt.Sprintf("framework with reference ID %q already exists for organization %s", e.ReferenceID, e.OrganizationID)
 }
@@ -169,6 +185,10 @@ LIMIT 1;
 
 	framework, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Framework])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrFrameworkNotFound{Identifier: referenceID}
+		}
+
 		return fmt.Errorf("cannot collect framework: %w", err)
 	}
 
@@ -211,6 +231,10 @@ LIMIT 1;
 
 	framework, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Framework])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrFrameworkNotFound{Identifier: frameworkID.String()}
+		}
+
 		return fmt.Errorf("cannot collect framework: %w", err)
 	}
 
@@ -311,7 +335,7 @@ SET
   name = @name,
   description = @description,
   updated_at = @updated_at
-WHERE 
+WHERE
   %s
   AND id = @framework_id
 `

pkg/coredata/measure.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 
 	"go.gearno.de/kit/pg"
 )
@@ -41,8 +43,24 @@ type (
 	}
 
 	Measures []*Measure
+
+	ErrMeasureNotFound struct {
+		Identifier string
+	}
+
+	ErrMeasureAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrMeasureNotFound) Error() string {
+	return fmt.Sprintf("measure not found: %q", e.Identifier)
+}
+
+func (e ErrMeasureAlreadyExists) Error() string {
+	return e.message
+}
+
 func (m Measure) CursorKey(orderBy MeasureOrderField) page.CursorKey {
 	switch orderBy {
 	case MeasureOrderFieldCreatedAt:
@@ -395,6 +413,10 @@ LIMIT 1;
 
 	measure, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Measure])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrMeasureNotFound{Identifier: measureID.String()}
+		}
+
 		return fmt.Errorf("cannot collect measures: %w", err)
 	}
 
@@ -525,7 +547,20 @@ VALUES (
 		"state":           m.State,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "mitigations_org_ref_unique" {
+				return &ErrMeasureAlreadyExists{
+					message: fmt.Sprintf("measure with organization_id %s and reference_id %q already exists", m.OrganizationID, m.ReferenceID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert measure: %w", err)
+	}
+
+	return nil
 }
 
 func (m *Measure) Update(

pkg/coredata/organization.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -43,8 +44,24 @@ type (
 	}
 
 	Organizations []*Organization
+
+	ErrOrganizationNotFound struct {
+		Identifier string
+	}
+
+	ErrOrganizationAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrOrganizationNotFound) Error() string {
+	return fmt.Sprintf("organization not found: %q", e.Identifier)
+}
+
+func (e ErrOrganizationAlreadyExists) Error() string {
+	return e.message
+}
+
 func (o Organization) CursorKey(orderBy OrganizationOrderField) page.CursorKey {
 	switch orderBy {
 	case OrganizationOrderFieldName:
@@ -98,6 +115,10 @@ LIMIT 1;
 
 	organization, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Organization])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrOrganizationNotFound{Identifier: organizationID.String()}
+		}
+
 		return fmt.Errorf("cannot collect organization: %w", err)
 	}
 
@@ -372,6 +393,10 @@ LIMIT 1
 
 	organization, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Organization])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrOrganizationNotFound{Identifier: customDomainID.String()}
+		}
+
 		return fmt.Errorf("cannot collect organization: %w", err)
 	}
 

pkg/coredata/people.go

@@ -47,12 +47,20 @@ type (
 	ErrPeopleNotFound struct {
 		Identifier string
 	}
+
+	ErrPeopleAlreadyExists struct {
+		message string
+	}
 )
 
 func (e ErrPeopleNotFound) Error() string {
 	return fmt.Sprintf("people not found: %s", e.Identifier)
 }
 
+func (e ErrPeopleAlreadyExists) Error() string {
+	return e.message
+}
+
 func (p People) CursorKey(orderBy PeopleOrderField) page.CursorKey {
 	switch orderBy {
 	case PeopleOrderFieldCreatedAt:
@@ -105,6 +113,10 @@ LIMIT 1;
 
 	people, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[People])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrPeopleNotFound{Identifier: peopleID.String()}
+		}
+
 		return fmt.Errorf("cannot collect people: %w", err)
 	}
 

pkg/coredata/risk.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -56,8 +57,24 @@ type (
 	RiskSnapshotter interface {
 		InsertRiskSnapshots(ctx context.Context, conn pg.Conn, scope Scoper, organizationID, snapshotID gid.GID) error
 	}
+
+	ErrRiskNotFound struct {
+		Identifier string
+	}
+
+	ErrRiskAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrRiskNotFound) Error() string {
+	return fmt.Sprintf("risk not found: %q", e.Identifier)
+}
+
+func (e ErrRiskAlreadyExists) Error() string {
+	return e.message
+}
+
 func (r *Risk) CursorKey(orderBy RiskOrderField) page.CursorKey {
 	switch orderBy {
 	case RiskOrderFieldCreatedAt:
@@ -374,6 +391,10 @@ LIMIT 1;
 
 	risk, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Risk])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrRiskNotFound{Identifier: riskID.String()}
+		}
+
 		return fmt.Errorf("cannot collect risk: %w", err)
 	}
 

pkg/coredata/session.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"time"
 
@@ -35,32 +36,34 @@ type (
 		UpdatedAt time.Time   `db:"updated_at"`
 	}
 
-	// SessionData stores authentication context for a user session
-	// Stored as JSONB in database
 	SessionData struct {
-		// PasswordAuthenticated indicates if user authenticated with email/password
-		// Required for accessing organizations without SAML
-		PasswordAuthenticated bool `json:"password_authenticated"`
-
-		// SAMLAuthenticatedOrgs tracks which organizations user has SAML-authenticated for
-		// Key: organization ID as string, Value: SAML authentication info
-		// Required for accessing organizations with SAML enforcement
+		PasswordAuthenticated bool                   `json:"password_authenticated"`
 		SAMLAuthenticatedOrgs map[string]SAMLAuthInfo `json:"saml_authenticated_orgs,omitempty"`
 	}
 
-	// SAMLAuthInfo stores SAML authentication details for an organization
 	SAMLAuthInfo struct {
-		// AuthenticatedAt is when the user SAML-
 		AuthenticatedAt time.Time `json:"authenticated_at"`
+		SAMLConfigID    gid.GID   `json:"saml_config_id"`
+		SAMLSubject     string    `json:"saml_subject"`
+	}
 
-		// SAMLConfigID is the SAML configuration used for authentication
-		SAMLConfigID gid.GID `json:"saml_config_id"`
+	ErrSessionNotFound struct {
+		Identifier string
+	}
 
-		// SAMLSubject is the NameID from the SAML assertion (email address)
-		SAMLSubject string `json:"saml_subject"`
+	ErrSessionAlreadyExists struct {
+		message string
 	}
 )
 
+func (e ErrSessionNotFound) Error() string {
+	return fmt.Sprintf("session not found: %q", e.Identifier)
+}
+
+func (e ErrSessionAlreadyExists) Error() string {
+	return e.message
+}
+
 func (s Session) CursorKey(orderBy SessionOrderField) page.CursorKey {
 	switch orderBy {
 	case SessionOrderFieldCreatedAt:
@@ -99,6 +102,10 @@ LIMIT 1;
 
 	session, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Session])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrSessionNotFound{Identifier: sessionID.String()}
+		}
+
 		return fmt.Errorf("cannot collect session: %w", err)
 	}
 	*s = session

pkg/coredata/task.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 
 	"go.gearno.de/kit/pg"
 )
@@ -44,8 +46,24 @@ type (
 	}
 
 	Tasks []*Task
+
+	ErrTaskNotFound struct {
+		Identifier string
+	}
+
+	ErrTaskAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrTaskNotFound) Error() string {
+	return fmt.Sprintf("task not found: %q", e.Identifier)
+}
+
+func (e ErrTaskAlreadyExists) Error() string {
+	return e.message
+}
+
 func (c Task) CursorKey(orderBy TaskOrderField) page.CursorKey {
 	switch orderBy {
 	case TaskOrderFieldCreatedAt:
@@ -95,6 +113,10 @@ LIMIT 1;
 
 	task, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Task])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrTaskNotFound{Identifier: taskID.String()}
+		}
+
 		return fmt.Errorf("cannot collect tasks: %w", err)
 	}
 
@@ -158,7 +180,20 @@ VALUES (
 		"updated_at":      c.UpdatedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
-	return err
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "tasks_reference_id_unique" {
+				return &ErrTaskAlreadyExists{
+					message: fmt.Sprintf("task with measure_id %s and reference_id %q already exists", c.MeasureID, c.ReferenceID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert task: %w", err)
+	}
+
+	return nil
 }
 
 func (c *Task) Upsert(

pkg/coredata/trust_center.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -39,8 +41,24 @@ type (
 	}
 
 	TrustCenters []*TrustCenter
+
+	ErrTrustCenterNotFound struct {
+		Identifier string
+	}
+
+	ErrTrustCenterAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrTrustCenterNotFound) Error() string {
+	return fmt.Sprintf("trust center not found: %q", e.Identifier)
+}
+
+func (e ErrTrustCenterAlreadyExists) Error() string {
+	return e.message
+}
+
 func (tc *TrustCenter) CursorKey(orderBy TrustCenterOrderField) page.CursorKey {
 	switch orderBy {
 	case TrustCenterOrderFieldCreatedAt:
@@ -218,6 +236,14 @@ INSERT INTO trust_centers (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "trust_centers_slug_key" {
+				return &ErrTrustCenterAlreadyExists{
+					message: fmt.Sprintf("trust center with slug %q already exists", tc.Slug),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center: %w", err)
 	}
 

pkg/coredata/trust_center_access.go

@@ -25,6 +25,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -49,12 +50,20 @@ type (
 	ErrTrustCenterAccessNotFound struct {
 		Identifier string
 	}
+
+	ErrTrustCenterAccessAlreadyExists struct {
+		message string
+	}
 )
 
 func (e ErrTrustCenterAccessNotFound) Error() string {
 	return fmt.Sprintf("trust center access not found: %s", e.Identifier)
 }
 
+func (e ErrTrustCenterAccessAlreadyExists) Error() string {
+	return e.message
+}
+
 func (tca *TrustCenterAccess) CursorKey(orderBy TrustCenterAccessOrderField) page.CursorKey {
 	switch orderBy {
 	case TrustCenterAccessOrderFieldCreatedAt:
@@ -216,6 +225,14 @@ INSERT INTO trust_center_accesses (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "trust_center_accesses_trust_center_id_email_key" {
+				return &ErrTrustCenterAccessAlreadyExists{
+					message: "trust center access already exists",
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center access: %w", err)
 	}
 

pkg/coredata/trust_center_document_access.go

@@ -24,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -45,12 +46,20 @@ type (
 	ErrTrustCenterDocumentAccessNotFound struct {
 		Identifier string
 	}
+
+	ErrTrustCenterDocumentAccessAlreadyExists struct {
+		message string
+	}
 )
 
 func (e ErrTrustCenterDocumentAccessNotFound) Error() string {
 	return fmt.Sprintf("trust center document access not found: %s", e.Identifier)
 }
 
+func (e ErrTrustCenterDocumentAccessAlreadyExists) Error() string {
+	return e.message
+}
+
 func (tcda *TrustCenterDocumentAccess) CursorKey(orderBy TrustCenterDocumentAccessOrderField) page.CursorKey {
 	switch orderBy {
 	case TrustCenterDocumentAccessOrderFieldCreatedAt:
@@ -254,6 +263,25 @@ INSERT INTO trust_center_document_accesses (
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				switch pgErr.ConstraintName {
+				case "trust_center_document_accesse_trust_center_access_id_docume_key":
+					return &ErrTrustCenterDocumentAccessAlreadyExists{
+						message: fmt.Sprintf("trust center document access with trust_center_access_id %s and document_id %s already exists", tcda.TrustCenterAccessID, tcda.DocumentID),
+					}
+				case "trust_center_document_accesse_trust_center_access_id_report_key":
+					return &ErrTrustCenterDocumentAccessAlreadyExists{
+						message: fmt.Sprintf("trust center document access with trust_center_access_id %s and report_id %s already exists", tcda.TrustCenterAccessID, tcda.ReportID),
+					}
+				case "trust_center_document_accesses_trust_center_file_id_key":
+					return &ErrTrustCenterDocumentAccessAlreadyExists{
+						message: fmt.Sprintf("trust center document access with trust_center_access_id %s and trust_center_file_id %s already exists", tcda.TrustCenterAccessID, tcda.TrustCenterFileID),
+					}
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center document access: %w", err)
 	}
 

pkg/coredata/trust_center_reference.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -42,12 +44,20 @@ type (
 	TrustCenterReferences []*TrustCenterReference
 
 	ErrTrustCenterReferenceNotFound struct {
-		ID string
+		Identifier string
+	}
+
+	ErrTrustCenterReferenceAlreadyExists struct {
+		message string
 	}
 )
 
 func (e ErrTrustCenterReferenceNotFound) Error() string {
-	return fmt.Sprintf("trust center reference not found: %s", e.ID)
+	return fmt.Sprintf("trust center reference not found: %q", e.Identifier)
+}
+
+func (e ErrTrustCenterReferenceAlreadyExists) Error() string {
+	return e.message
 }
 
 func (t TrustCenterReference) CursorKey(orderBy TrustCenterReferenceOrderField) page.CursorKey {
@@ -156,6 +166,14 @@ RETURNING rank;
 
 	err := conn.QueryRow(ctx, q, args).Scan(&t.Rank)
 	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "trust_center_references_trust_center_id_rank_key" {
+				return &ErrTrustCenterReferenceAlreadyExists{
+					message: fmt.Sprintf("trust center reference with trust_center_id %s and rank already exists", t.TrustCenterID),
+				}
+			}
+		}
 		return fmt.Errorf("cannot insert trust center reference: %w", err)
 	}
 
@@ -198,7 +216,7 @@ WHERE
 	}
 
 	if result.RowsAffected() == 0 {
-		return ErrTrustCenterReferenceNotFound{ID: t.ID.String()}
+		return ErrTrustCenterReferenceNotFound{Identifier: t.ID.String()}
 	}
 
 	return nil

pkg/coredata/vendor.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -62,8 +63,24 @@ type (
 	VendorSnapshotter interface {
 		InsertVendorSnapshots(ctx context.Context, conn pg.Conn, scope Scoper, organizationID, snapshotID gid.GID) error
 	}
+
+	ErrVendorNotFound struct {
+		Identifier string
+	}
+
+	ErrVendorAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrVendorNotFound) Error() string {
+	return fmt.Sprintf("vendor not found: %q", e.Identifier)
+}
+
+func (e ErrVendorAlreadyExists) Error() string {
+	return e.message
+}
+
 func (v Vendor) CursorKey(orderBy VendorOrderField) page.CursorKey {
 	switch orderBy {
 	case VendorOrderFieldCreatedAt:
@@ -133,6 +150,10 @@ LIMIT 1;
 
 	vendor, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Vendor])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrVendorNotFound{Identifier: vendorID.String()}
+		}
+
 		return fmt.Errorf("cannot collect vendor: %w", err)
 	}
 

pkg/coredata/vendor_business_associate_agreement.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -41,8 +43,24 @@ type (
 	}
 
 	VendorBusinessAssociateAgreements []*VendorBusinessAssociateAgreement
+
+	ErrVendorBusinessAssociateAgreementNotFound struct {
+		Identifier string
+	}
+
+	ErrVendorBusinessAssociateAgreementAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrVendorBusinessAssociateAgreementNotFound) Error() string {
+	return fmt.Sprintf("vendor business associate agreement not found: %q", e.Identifier)
+}
+
+func (e ErrVendorBusinessAssociateAgreementAlreadyExists) Error() string {
+	return e.message
+}
+
 func (v VendorBusinessAssociateAgreement) CursorKey(orderBy VendorBusinessAssociateAgreementOrderField) page.CursorKey {
 	switch orderBy {
 	case VendorBusinessAssociateAgreementOrderFieldValidFrom:
@@ -241,7 +259,18 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	}
 
 	_, err := conn.Exec(ctx, q, args)
-	return err
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_business_associate_agreements_source_id_snapshot_id_key" {
+				return &ErrVendorBusinessAssociateAgreementAlreadyExists{
+					message: fmt.Sprintf("vendor business associate agreement with source_id %s and snapshot_id %s already exists", vbaa.SourceID, vbaa.SnapshotID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot upsert vendor business associate agreement: %w", err)
+	}
+	return nil
 }
 
 func (vbaa *VendorBusinessAssociateAgreement) Delete(

pkg/coredata/vendor_data_privacy_agreement.go

@@ -16,6 +16,7 @@ package coredata
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -23,6 +24,7 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"go.gearno.de/kit/pg"
 )
 
@@ -41,8 +43,24 @@ type (
 	}
 
 	VendorDataPrivacyAgreements []*VendorDataPrivacyAgreement
+
+	ErrVendorDataPrivacyAgreementNotFound struct {
+		Identifier string
+	}
+
+	ErrVendorDataPrivacyAgreementAlreadyExists struct {
+		message string
+	}
 )
 
+func (e ErrVendorDataPrivacyAgreementNotFound) Error() string {
+	return fmt.Sprintf("vendor data privacy agreement not found: %q", e.Identifier)
+}
+
+func (e ErrVendorDataPrivacyAgreementAlreadyExists) Error() string {
+	return e.message
+}
+
 func (v VendorDataPrivacyAgreement) CursorKey(orderBy VendorDataPrivacyAgreementOrderField) page.CursorKey {
 	switch orderBy {
 	case VendorDataPrivacyAgreementOrderFieldValidFrom:
@@ -241,7 +259,18 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	}
 
 	_, err := conn.Exec(ctx, q, args)
-	return err
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_data_privacy_agreements_source_id_snapshot_id_key" {
+				return &ErrVendorDataPrivacyAgreementAlreadyExists{
+					message: fmt.Sprintf("vendor data privacy agreement with source_id %s and snapshot_id %s already exists", vdpa.SourceID, vdpa.SnapshotID),
+				}
+			}
+		}
+		return fmt.Errorf("cannot upsert vendor data privacy agreement: %w", err)
+	}
+	return nil
 }
 
 func (vdpa *VendorDataPrivacyAgreement) Delete(

pkg/probo/document_service.go

@@ -276,7 +276,9 @@ func (s *DocumentService) publishVersionInTx(
 		if publishedVersion.Content == documentVersion.Content &&
 			publishedVersion.Title == documentVersion.Title &&
 			publishedVersion.OwnerID == documentVersion.OwnerID {
-			return nil, nil, fmt.Errorf("cannot publish version: no changes detected")
+			return nil, nil, &coredata.ErrDocumentVersionNoChanges{
+				Message: "no changes detected",
+			}
 		}
 	}
 

pkg/server/api/console/v1/resolver.go

@@ -441,7 +441,7 @@ func validateTenantAccess(ctx context.Context, tenantID gid.TenantID) {
 	access, _ := ctx.Value(userTenantContextKey).(*userTenantAccess)
 
 	if access == nil {
-		panic(fmt.Errorf("tenant not found"))
+		panic(&authz.TenantAccessError{Message: "tenant not found"})
 	}
 
 	if !slices.Contains(access.tenantIDs, tenantID) {
@@ -451,6 +451,6 @@ func validateTenantAccess(ctx context.Context, tenantID gid.TenantID) {
 			}
 		}
 
-		panic(fmt.Errorf("access denied to tenant"))
+		panic(&authz.TenantAccessError{Message: "tenant not found"})
 	}
 }

pkg/server/graphql/errors.go

@@ -0,0 +1,69 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package graphql
+
+import (
+	"maps"
+
+	"github.com/vektah/gqlparser/v2/gqlerror"
+)
+
+func Unauthorized() *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: "not authorized",
+		Extensions: map[string]any{
+			"code": "UNAUTHORIZED",
+		},
+	}
+}
+
+func AuthenticationRequired(details map[string]any) *gqlerror.Error {
+	extensions := map[string]any{
+		"code": "AUTHENTICATION_REQUIRED",
+	}
+	maps.Copy(extensions, details)
+
+	return &gqlerror.Error{
+		Message:    "Additional authentication required to access this organization",
+		Extensions: extensions,
+	}
+}
+
+func NotFound(err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Extensions: map[string]any{
+			"code": "NOT_FOUND",
+		},
+	}
+}
+
+func Conflict(err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Extensions: map[string]any{
+			"code": "CONFLICT",
+		},
+	}
+}
+
+func Invalid(err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Extensions: map[string]any{
+			"code": "INVALID",
+		},
+	}
+}

pkg/server/graphql/recovery.go

@@ -20,6 +20,7 @@ import (
 	"runtime/debug"
 
 	"github.com/getprobo/probo/pkg/auth"
+	"github.com/getprobo/probo/pkg/authz"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"
@@ -32,29 +33,26 @@ func RecoverFunc(ctx context.Context, err any) error {
 
 	var errSAMLRequired auth.ErrSAMLAuthRequired
 	if errors.As(asError(err), &errSAMLRequired) {
-		return &gqlerror.Error{
-			Message: "Additional authentication required to access this organization",
-			Extensions: map[string]any{
-				"code":           "AUTHENTICATION_REQUIRED",
-				"requiresSaml":   true,
-				"redirectUrl":    errSAMLRequired.RedirectURL,
-				"samlConfigId":   errSAMLRequired.ConfigID.String(),
-				"organizationId": errSAMLRequired.OrganizationID.String(),
-			},
-		}
+		return AuthenticationRequired(map[string]any{
+			"requiresSaml":   true,
+			"redirectUrl":    errSAMLRequired.RedirectURL,
+			"samlConfigId":   errSAMLRequired.ConfigID.String(),
+			"organizationId": errSAMLRequired.OrganizationID.String(),
+		})
 	}
 
 	var errPasswordRequired auth.ErrPasswordAuthRequired
 	if errors.As(asError(err), &errPasswordRequired) {
-		return &gqlerror.Error{
-			Message: "Additional authentication required to access this organization",
-			Extensions: map[string]any{
-				"code":           "AUTHENTICATION_REQUIRED",
-				"requiresSaml":   false,
-				"redirectUrl":    errPasswordRequired.RedirectURL,
-				"organizationId": errPasswordRequired.OrganizationID.String(),
-			},
-		}
+		return AuthenticationRequired(map[string]any{
+			"requiresSaml":   false,
+			"redirectUrl":    errPasswordRequired.RedirectURL,
+			"organizationId": errPasswordRequired.OrganizationID.String(),
+		})
+	}
+
+	var tenantAccessErr *authz.TenantAccessError
+	if errTyped, ok := err.(error); ok && errors.As(errTyped, &tenantAccessErr) {
+		return Unauthorized()
 	}
 
 	logger := httpserver.LoggerFromContext(ctx)