feat(identity): throw UnauthorizedError if input and context identi…

…ty URNs do not match
proofzero · Feb 29, 2024 · f534409 · f534409
1 parent 10d8fef
commit f534409
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/platform/identity/src/jsonrpc/methods/getAuthorizedApps.ts b/platform/identity/src/jsonrpc/methods/getAuthorizedApps.ts
@@ -45,6 +45,8 @@ export const getAuthorizedAppsMethod = async ({
   if (!ctx.identityURN)
     throw new UnauthorizedError({ message: 'identity not found' })
 
+  if (ctx.identityURN !== input.identity) throw new UnauthorizedError()
+
   const caller = router.createCaller(ctx)
   const edgesResult = await caller.edges.getEdges({
     query: {

diff --git a/platform/identity/src/jsonrpc/methods/hasAccounts.ts b/platform/identity/src/jsonrpc/methods/hasAccounts.ts
@@ -1,6 +1,8 @@
 import * as set from 'ts-set-utils'
 import { z } from 'zod'
 
+import { UnauthorizedError } from '@proofzero/errors'
+
 import { router } from '@proofzero/platform.core'
 import { inputValidators } from '@proofzero/platform-middleware'
 
@@ -39,9 +41,8 @@ export const hasAccountsMethod = async ({
   input: HasAccountsInput
   ctx: Context
 }): Promise<HasAccountsOutput> => {
-  if (input.identity !== ctx.identityURN) {
-    throw Error('Invalid identity input')
-  }
+  if (ctx.identityURN !== input.identity) throw new UnauthorizedError()
+
   // Return the list of edges between the identity node and any
   // account nodes. Don't filter the accounts by type, we want them
   // all (the total number is normally going to be small).