Secrets: Error standardization - Secrets API

pkg/api/errors/secrets.go

@@ -0,0 +1,104 @@
+/*
+ *
+ * Copyright 2024 The Dapr Authors
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * /
+ */
+
+package errors
+
+import (
+ "fmt"
+ "net/http"
+
+ "github.com/dapr/kit/errors"
+ "google.golang.org/grpc/codes"
+)
+
+type SecretsStoreError struct {
+ name string
+ skipResourceInfo bool
+}
+
+func SecretsStore(name string) *SecretsStoreError {
+ return &SecretsStoreError{
+ name: name,
+ }
+}
+
+func (s *SecretsStoreError) NotConfigured() error {
+ return s.build(
+ errors.NewBuilder(
+ codes.FailedPrecondition,
+ http.StatusInternalServerError,
+ fmt.Sprintf("secret store is not configured"),
+ "ERR_SECRET_STORES_NOT_CONFIGURED",
+ ),
+ "NOT_CONFIGURED",
+ )
+}
+
+func (s *SecretsStoreError) PermissionDenied(key string) error {
+ return s.build(
+ errors.NewBuilder(
+ codes.PermissionDenied,
+ http.StatusForbidden,
+ fmt.Sprintf("access denied by policy to get %q from %q", key, s.name),
+ "ERR_SECRETS_PERMISSION_DENIED",
+ ),
+ "PERMISSION_DENIED",
+ )
+}
+
+func (s *SecretsStoreError) NotFound() error {
+ return s.build(
+ errors.NewBuilder(
+ codes.InvalidArgument,
+ http.StatusUnauthorized,
+ fmt.Sprintf("failed finding secret store with key %s", s.name),
+ "ERR_SECRET_STORE_NOT_FOUND",
+ ),
+ "NOT_FOUND",
+ )
+}
+
+func (s *SecretsStoreError) GetSecret(key string, error string) error {
+ return s.build(
+ errors.NewBuilder(
+ codes.Internal,
+ http.StatusInternalServerError,
+ fmt.Sprintf("failed getting secret with key %s from secret store %s: %s", key, s.name, error),
+ "ERR_SECRET_GET",
+ ),
+ "SECRET_GET",
+ )
+}
+
+func (s *SecretsStoreError) BulkSecretGet(error string) error {
+ return s.build(
+ errors.NewBuilder(
+ codes.Internal,
+ http.StatusInternalServerError,
+ fmt.Sprintf("failed getting secrets from secret store %s: %v", s.name, error),
+ "ERR_SECRET_GET",
+ ),
+ "SECRET_GET",
+ )
+}
+
+func (s *SecretsStoreError) build(err *errors.ErrorBuilder, errCode string) error {
+ if !s.skipResourceInfo {
+ err = err.WithResourceInfo("secrets", s.name, "", "")
+ }
+ return err.
+ WithErrorInfo(errors.CodePrefixSecretStore+errCode, nil).
+ Build()
+}

pkg/api/universal/secrets.go

@@ -18,8 +18,8 @@
  "time"
 
  "github.com/dapr/components-contrib/secretstores"
+ apierrors "github.com/dapr/dapr/pkg/api/errors"
  diag "github.com/dapr/dapr/pkg/diagnostics"
- "github.com/dapr/dapr/pkg/messages"
  runtimev1pb "github.com/dapr/dapr/pkg/proto/runtime/v1"
  "github.com/dapr/dapr/pkg/resiliency"
 )
@@ -33,7 +33,9 @@
  }
 
  if !a.isSecretAllowed(in.GetStoreName(), in.GetKey()) {
- err = messages.ErrSecretPermissionDenied.WithFormat(in.GetKey(), in.GetStoreName())
+ err := apierrors.
+ SecretsStore(in.GetStoreName()).
+ PermissionDenied(in.GetKey())
  a.logger.Debug(err)
  return response, err
  }
@@ -56,7 +58,7 @@
  diag.DefaultComponentMonitoring.SecretInvoked(ctx, in.GetStoreName(), diag.Get, err == nil, elapsed)
 
  if err != nil {
- err = messages.ErrSecretGet.WithFormat(req.Name, in.GetStoreName(), err.Error())
+ err = apierrors.SecretsStore(in.GetStoreName()).GetSecret(req.Name, err.Error())
  a.logger.Debug(err)
  return response, err
  }
@@ -94,7 +96,7 @@
  diag.DefaultComponentMonitoring.SecretInvoked(ctx, in.GetStoreName(), diag.BulkGet, err == nil, elapsed)
 
  if err != nil {
- err = messages.ErrBulkSecretGet.WithFormat(in.GetStoreName(), err.Error())
+ err = apierrors.SecretsStore(in.GetStoreName()).BulkSecretGet(err.Error())
  a.logger.Debug(err)
  return response, err
  }
@@ -107,7 +109,10 @@
  if a.isSecretAllowed(in.GetStoreName(), key) {
  filteredSecrets[key] = v
  } else {
- a.logger.Debugf(messages.ErrSecretPermissionDenied.WithFormat(key, in.GetStoreName()).String())
+ err = apierrors.
+ SecretsStore(in.GetStoreName()).
+ PermissionDenied(key)
+ a.logger.Debug(err)
  }
  }
 
@@ -125,14 +130,14 @@
 // Internal method that checks if the request is for a valid secret store component.
 func (a *Universal) secretsValidateRequest(componentName string) (secretstores.SecretStore, error) {
  if a.compStore.SecretStoresLen() == 0 {
- err := messages.ErrSecretStoreNotConfigured
+ err := apierrors.SecretsStore(componentName).NotConfigured()
  a.logger.Debug(err)
  return nil, err
  }
 
  component, ok := a.compStore.GetSecretStore(componentName)
  if !ok {
- err := messages.ErrSecretStoreNotFound.WithFormat(componentName)
+ err := apierrors.SecretsStore(componentName).NotFound()
  a.logger.Debug(err)
  return nil, err
  }

pkg/api/universal/secrets_test.go

@@ -25,7 +25,6 @@ import (
 
  "github.com/dapr/components-contrib/secretstores"
  "github.com/dapr/dapr/pkg/config"
- "github.com/dapr/dapr/pkg/messages"
  runtimev1pb "github.com/dapr/dapr/pkg/proto/runtime/v1"
  "github.com/dapr/dapr/pkg/resiliency"
  "github.com/dapr/dapr/pkg/runtime/compstore"
@@ -43,13 +42,13 @@ func TestSecretStoreNotConfigured(t *testing.T) {
  t.Run("GetSecret", func(t *testing.T) {
  _, err := fakeAPI.GetSecret(context.Background(), &runtimev1pb.GetSecretRequest{})
  require.Error(t, err)
- require.ErrorIs(t, err, messages.ErrSecretStoreNotConfigured)
+ require.Contains(t, err.Error(), "secret store is not configured")
  })
 
  t.Run("GetBulkSecret", func(t *testing.T) {
  _, err := fakeAPI.GetBulkSecret(context.Background(), &runtimev1pb.GetBulkSecretRequest{})
  require.Error(t, err)
- require.ErrorIs(t, err, messages.ErrSecretStoreNotConfigured)
+ require.Contains(t, err.Error(), "secret store is not configured")
  })
 }
 

pkg/messages/predefined.go

@@ -75,13 +75,6 @@ var (
  ErrOutboundHealthNotReady = APIError{"dapr outbound is not ready", "ERR_OUTBOUND_HEALTH_NOT_READY", http.StatusInternalServerError, grpcCodes.Internal}
  ErrHealthAppIDNotMatch = APIError{"dapr app-id does not match", "ERR_HEALTH_APPID_NOT_MATCH", http.StatusInternalServerError, grpcCodes.Internal}
 
- // Secrets.
- ErrSecretStoreNotConfigured = APIError{"secret store is not configured", "ERR_SECRET_STORES_NOT_CONFIGURED", http.StatusInternalServerError, grpcCodes.FailedPrecondition}
- ErrSecretStoreNotFound = APIError{"failed finding secret store with key %s", "ERR_SECRET_STORE_NOT_FOUND", http.StatusUnauthorized, grpcCodes.InvalidArgument}
- ErrSecretPermissionDenied = APIError{"access denied by policy to get %q from %q", "ERR_PERMISSION_DENIED", http.StatusForbidden, grpcCodes.PermissionDenied}
- ErrSecretGet = APIError{"failed getting secret with key %s from secret store %s: %s", "ERR_SECRET_GET", http.StatusInternalServerError, grpcCodes.Internal}
- ErrBulkSecretGet = APIError{"failed getting secrets from secret store %s: %v", "ERR_SECRET_GET", http.StatusInternalServerError, grpcCodes.Internal}
-
  // Crypto.
  ErrCryptoProvidersNotConfigured = APIError{"crypto providers not configured", "ERR_CRYPTO_PROVIDERS_NOT_CONFIGURED", http.StatusInternalServerError, grpcCodes.Internal}
  ErrCryptoProviderNotFound = APIError{"crypto provider %s not found", "ERR_CRYPTO_PROVIDER_NOT_FOUND", http.StatusBadRequest, grpcCodes.InvalidArgument}