From 4ba3a829738d54db0fbfc2c77b199be5afc4d369 Mon Sep 17 00:00:00 2001 From: Michael Barz Date: Tue, 19 Sep 2023 15:55:02 +0200 Subject: [PATCH 1/2] Add denied error body to docs --- services/policies/README.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/services/policies/README.md b/services/policies/README.md index 93414a33ae..918ec1f77f 100644 --- a/services/policies/README.md +++ b/services/policies/README.md @@ -42,6 +42,26 @@ The gRPC API can be used by any other internal service. It can also be used for The proxy service already includes a middleware which uses the internal [gRPC API](#grpc-api) to evaluate the policies. Since the proxy is in heavy use and every HTTP request is processed here, only simple and quick decisions should be evaluated. More complex queries such as file content evaluation are _strongly_ discouraged. +When the evaluation in the proxy results in a "denied" outcome, the response will return a `403 Permission Denied` with the following response body + +```json +{ + "error": + { + "code": "deniedByPolicy", + "message": "Operation denied due to security policies", + "innererror": + { + "date": "2023-09-19T13:22:20Z", + "filename": "File", + "method": "POST", + "path": "/dav/spaces/some-space-id/Folder/", + "request-id": "9CFCE925-F9D9-4F26-AB3B-2C1C40A9CD0C" + } + } +} +``` + ### Event Service (Postprocessing) This layer is event-based and part of the postprocessing service. Since processing at this point is asynchronous, the operations can also take longer and be more expensive, like evaluating the contents of a file. From b09a90b92778ab57afe11c182630a09df5e106b2 Mon Sep 17 00:00:00 2001 From: Michael Barz Date: Wed, 20 Sep 2023 10:16:13 +0200 Subject: [PATCH 2/2] Update services/policies/README.md Co-authored-by: Martin --- services/policies/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/policies/README.md b/services/policies/README.md index 918ec1f77f..50d60850ef 100644 --- a/services/policies/README.md +++ b/services/policies/README.md @@ -42,7 +42,7 @@ The gRPC API can be used by any other internal service. It can also be used for The proxy service already includes a middleware which uses the internal [gRPC API](#grpc-api) to evaluate the policies. Since the proxy is in heavy use and every HTTP request is processed here, only simple and quick decisions should be evaluated. More complex queries such as file content evaluation are _strongly_ discouraged. -When the evaluation in the proxy results in a "denied" outcome, the response will return a `403 Permission Denied` with the following response body +If the evaluation in the proxy results in a "denied" outcome, the response will return a `403 Permission Denied` with the following response body ```json {