Releases · hmrc/pillar2-submission-api

29 Jan 12:04

0.71.0 Latest

Latest

Release : pillar2-submission-api 0.71.0

Last commit sha : b8e4b98
Last commit author : James Miller
Last commit time : 2025-01-29T11:08:58Z

Refactor AuthenticatedIdentifierAction Error Handling (#70)

This PR improves the error handling in the AuthenticatedIdentifierAction by:

Generalising Error Messages: Replaces specific authentication failure messages with more generic ones to avoid exposing internal logic.
Updating HTTP Status Codes:
- 400 Bad Request: For client-side errors like missing or malformed headers.
- 403 Forbidden: When the client is authenticated but does not have the necessary permissions/criteria.
- 401 Unauthorized: Retained for general authentication failures.

Changes

Updated AuthenticatedIdentifierAction.scala to handle different error scenarios with appropriate HTTP status codes.
Modified Pillar2Error.scala to include new error types (ForbiddenError, MissingHeader) and update existing ones.
Updated submission.routes to reflect the new error responses with correct status codes, messages and examples. from this subsequently generated a new openApi spec.
Revised Pillar2ErrorHandlerSpec.scala to test the new generic error messages.
Updated AuthenticatedIdentifierActionSpec.scala to cover the new error scenarios and status codes.

This PR addresses the following issues:

Exposure of Detailed Reasons: Prevents detailed internal error messages from being exposed to clients.
HTTP Status Mapping: Ensures that HTTP status codes accurately represent the nature of failures.

Assets 2

29 Jan 11:17

0.70.0

Release : pillar2-submission-api 0.70.0

Last commit sha : b8e4b98
Last commit author : James Miller
Last commit time : 2025-01-29T11:08:58Z

Refactor AuthenticatedIdentifierAction Error Handling (#70)

This PR improves the error handling in the AuthenticatedIdentifierAction by:

Generalising Error Messages: Replaces specific authentication failure messages with more generic ones to avoid exposing internal logic.
Updating HTTP Status Codes:
- 400 Bad Request: For client-side errors like missing or malformed headers.
- 403 Forbidden: When the client is authenticated but does not have the necessary permissions/criteria.
- 401 Unauthorized: Retained for general authentication failures.

Updated AuthenticatedIdentifierAction.scala to handle different error scenarios with appropriate HTTP status codes.
Modified Pillar2Error.scala to include new error types (ForbiddenError, MissingHeader) and update existing ones.
Updated submission.routes to reflect the new error responses with correct status codes, messages and examples. from this subsequently generated a new openApi spec.
Revised Pillar2ErrorHandlerSpec.scala to test the new generic error messages.
Updated AuthenticatedIdentifierActionSpec.scala to cover the new error scenarios and status codes.

This PR addresses the following issues:

Exposure of Detailed Reasons: Prevents detailed internal error messages from being exposed to clients.
HTTP Status Mapping: Ensures that HTTP status codes accurately represent the nature of failures.

Assets 2