Catch assumption needed errors

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/iam/authorizer.go

@@ -99,7 +99,7 @@ func (a *Authorizer) authorize(ctx context.Context, conn pg.Conn, params Authori
 			var errSessionExpired *ErrSessionExpired
 
 			if errors.As(err, &errSessionNotFound) || errors.As(err, &errSessionExpired) {
-				return NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action)
+				return NewAssumptionNeededError(params.Principal, membership.ID)
 			}
 
 			return fmt.Errorf("cannot get active child session for membership: %w", err)

pkg/iam/errors.go

@@ -183,6 +183,19 @@ func (e ErrInsufficientPermissions) Error() string {
 	return fmt.Sprintf("identity %q does not have sufficient permissions to perform action %s on entity %q", e.IdentityID, e.Action, e.EntityID)
 }
 
+type ErrAssumptionNeeded struct {
+	IdentityID   gid.GID
+	MembershipID gid.GID
+}
+
+func NewAssumptionNeededError(identityID gid.GID, membershipID gid.GID) error {
+	return &ErrAssumptionNeeded{IdentityID: identityID, MembershipID: membershipID}
+}
+
+func (e ErrAssumptionNeeded) Error() string {
+	return fmt.Sprintf("assumption for identity %q needed for membership %q", e.IdentityID, e.MembershipID)
+}
+
 type ErrSessionNotFound struct{ SessionID gid.GID }
 
 func NewSessionNotFoundError(sessionID gid.GID) error {

pkg/server/api/authz/authorization.go

@@ -72,6 +72,11 @@ func NewAuthorizeFunc(
 		}
 
 		if err := svc.Authorizer.Authorize(ctx, params); err != nil {
+			var errAssumptionNeeded *iam.ErrAssumptionNeeded
+			if errors.As(err, &errAssumptionNeeded) {
+				return gqlutils.NotAssuming(ctx, err)
+			}
+
 			var errInsufficientPermissions *iam.ErrInsufficientPermissions
 			if errors.As(err, &errInsufficientPermissions) {
 				return gqlutils.Forbidden(ctx, err)

pkg/server/gqlutils/errors.go

@@ -52,6 +52,20 @@ func Unauthenticatedf(ctx context.Context, format string, a ...any) *gqlerror.Er
 	return Unauthenticated(ctx, fmt.Errorf(format, a...))
 }
 
+func NotAssuming(ctx context.Context, err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Path:    graphql.GetPath(ctx),
+		Extensions: map[string]any{
+			"code": "NOT_ASSUMING",
+		},
+	}
+}
+
+func NotAssumingf(ctx context.Context, format string, a ...any) *gqlerror.Error {
+	return NotAssuming(ctx, fmt.Errorf(format, a...))
+}
+
 func Forbidden(ctx context.Context, err error) *gqlerror.Error {
 	return &gqlerror.Error{
 		Message: err.Error(),