From bed0f6293bc39558bc0f55f3a222db3b45ae38b4 Mon Sep 17 00:00:00 2001 From: Silvan Date: Thu, 28 Mar 2024 13:19:03 +0100 Subject: [PATCH] fix: check error before using token (#7664) --- .../repository/eventsourcing/eventstore/token_verifier.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go index d1f22eb21..a64951de8 100644 --- a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go +++ b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go @@ -110,15 +110,15 @@ func (repo *TokenVerifierRepo) verifyAccessTokenV1(ctx context.Context, tokenID, ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() - _, tokenSpan := tracing.NewNamedSpan(ctx, "token") + _, tokenSpan := tracing.NewNamedSpan(ctx, "tokenByID") token, err := repo.tokenByID(ctx, tokenID, subject) - if token.Actor != nil { - return "", "", "", "", "", zerrors.ThrowPermissionDenied(nil, "APP-wai8O", "Errors.TokenExchange.Token.NotForAPI") - } tokenSpan.EndWithError(err) if err != nil { return "", "", "", "", "", zerrors.ThrowUnauthenticated(err, "APP-BxUSiL", "invalid token") } + if token.Actor != nil { + return "", "", "", "", "", zerrors.ThrowPermissionDenied(nil, "APP-wai8O", "Errors.TokenExchange.Token.NotForAPI") + } if !token.Expiration.After(time.Now().UTC()) { return "", "", "", "", "", zerrors.ThrowUnauthenticated(err, "APP-k9KS0", "invalid token") }