graphql: T4574: add specific error message if token has expired

Catch expiration error and return error-specific message instead of
general 'not authenticated'.

3 files changed, 15 insertions, 0 deletions

diff --git a/src/services/api/graphql/graphql/mutations.py b/src/services/api/graphql/graphql/mutations.py
index 31cb1afc4..87ea59c43 100644
--- a/src/services/api/graphql/graphql/mutations.py
+++ b/src/services/api/graphql/graphql/mutations.py
@@ -73,6 +73,12 @@ def make_mutation_resolver(mutation_name, class_name, session_func):
                 info = kwargs['info']
                 user = info.context.get('user')
                 if user is None:
+                    error = info.context.get('error')
+                    if error is not None:
+                        return {
+                            "success": False,
+                            "errors": [error]
+                        }
                     return {
                         "success": False,
                         "errors": ['not authenticated']
diff --git a/src/services/api/graphql/graphql/queries.py b/src/services/api/graphql/graphql/queries.py
index 3a88e3c80..1ad586428 100644
--- a/src/services/api/graphql/graphql/queries.py
+++ b/src/services/api/graphql/graphql/queries.py
@@ -73,6 +73,12 @@ def make_query_resolver(query_name, class_name, session_func):
                 info = kwargs['info']
                 user = info.context.get('user')
                 if user is None:
+                    error = info.context.get('error')
+                    if error is not None:
+                        return {
+                            "success": False,
+                            "errors": [error]
+                        }
                     return {
                         "success": False,
                         "errors": ['not authenticated']
diff --git a/src/services/api/graphql/libs/token_auth.py b/src/services/api/graphql/libs/token_auth.py
index 3ecd8b855..2100eba7f 100644
--- a/src/services/api/graphql/libs/token_auth.py
+++ b/src/services/api/graphql/libs/token_auth.py
@@ -54,6 +54,9 @@ def get_user_context(request):
             user_id: str = payload.get('sub')
             if user_id is None:
                 return context
+        except jwt.exceptions.ExpiredSignatureError:
+            context['error'] = 'expired token'
+            return context
         except jwt.PyJWTError:
             return context
         try: