diff --git a/src/Kyoo.Authentication/Controllers/PermissionValidator.cs b/src/Kyoo.Authentication/Controllers/PermissionValidator.cs index 0b4f8768..8b10de9b 100644 --- a/src/Kyoo.Authentication/Controllers/PermissionValidator.cs +++ b/src/Kyoo.Authentication/Controllers/PermissionValidator.cs @@ -22,6 +22,7 @@ using System.Linq; using System.Threading.Tasks; using Kyoo.Abstractions.Controllers; using Kyoo.Abstractions.Models.Permissions; +using Kyoo.Abstractions.Models.Utils; using Kyoo.Authentication.Models; using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Authentication.JwtBearer; @@ -173,15 +174,28 @@ namespace Kyoo.Authentication { ICollection permissions = res.Principal.GetPermissions(); if (permissions.All(x => x != permStr && x != overallStr)) - context.Result = new StatusCodeResult(StatusCodes.Status403Forbidden); + { + context.Result = _ErrorResult($"Missing permission: {permStr}", StatusCodes.Status403Forbidden); + } } else { ICollection permissions = _options.CurrentValue.Default ?? Array.Empty(); if (res.Failure != null || permissions.All(x => x != permStr && x != overallStr)) - context.Result = new StatusCodeResult(StatusCodes.Status401Unauthorized); + context.Result = _ErrorResult($"Unlogged user does not have permission: {permStr}", StatusCodes.Status401Unauthorized); } } } + + /// + /// Create a new action result with the given error message and error code. + /// + /// The error message. + /// The status code of the error. + /// The resulting error action. + private static IActionResult _ErrorResult(string error, int code) + { + return new ObjectResult(new RequestError(error)) { StatusCode = code }; + } } } diff --git a/src/Kyoo.Authentication/Views/AuthApi.cs b/src/Kyoo.Authentication/Views/AuthApi.cs index 10dbdccb..2f0ca6df 100644 --- a/src/Kyoo.Authentication/Views/AuthApi.cs +++ b/src/Kyoo.Authentication/Views/AuthApi.cs @@ -230,7 +230,7 @@ namespace Kyoo.Authentication.Views /// The new data for the current user. /// The currently authenticated user after modifications. /// The given access token is invalid. - [HttpPut("me")] + [HttpPatch("me")] [UserOnly] [ProducesResponseType(StatusCodes.Status200OK)] [ProducesResponseType(StatusCodes.Status403Forbidden)]