From 663d44fe82359f38a71c4cc19352c8351ede1ea4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Agn=C3=A8s=20Toulet?=
 <35176601+AgnesToulet@users.noreply.github.com>
Date: Thu, 25 Feb 2021 15:30:51 +0100
Subject: [PATCH] Login: handle custom token creation error messages (#31283)

* Login: handle custom token creation errors

* Login: handle external error for OAuth responses
---
 pkg/api/login.go         | 20 +++++++++++++++++---
 pkg/models/user_token.go | 14 ++++++++++++++
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/pkg/api/login.go b/pkg/api/login.go
index 2b1d6f67d67..50cdeaefb22 100644
--- a/pkg/api/login.go
+++ b/pkg/api/login.go
@@ -225,7 +225,12 @@ func (hs *HTTPServer) LoginPost(c *models.ReqContext, cmd dtos.LoginCommand) res
 
 	err = hs.loginUserWithUser(user, c)
 	if err != nil {
-		resp = response.Error(http.StatusInternalServerError, "Error while signing in user", err)
+		var createTokenErr *models.CreateTokenErr
+		if errors.As(err, &createTokenErr) {
+			resp = response.Error(createTokenErr.StatusCode, createTokenErr.ExternalErr, createTokenErr.InternalErr)
+		} else {
+			resp = response.Error(http.StatusInternalServerError, "Error while signing in user", err)
+		}
 		return resp
 	}
 
@@ -321,7 +326,7 @@ func (hs *HTTPServer) trySetEncryptedCookie(ctx *models.ReqContext, cookieName s
 
 func (hs *HTTPServer) redirectWithError(ctx *models.ReqContext, err error, v ...interface{}) {
 	ctx.Logger.Error(err.Error(), v...)
-	if err := hs.trySetEncryptedCookie(ctx, loginErrorCookieName, err.Error(), 60); err != nil {
+	if err := hs.trySetEncryptedCookie(ctx, loginErrorCookieName, getLoginExternalError(err), 60); err != nil {
 		hs.log.Error("Failed to set encrypted cookie", "err", err)
 	}
 
@@ -330,9 +335,18 @@ func (hs *HTTPServer) redirectWithError(ctx *models.ReqContext, err error, v ...
 
 func (hs *HTTPServer) RedirectResponseWithError(ctx *models.ReqContext, err error, v ...interface{}) *response.RedirectResponse {
 	ctx.Logger.Error(err.Error(), v...)
-	if err := hs.trySetEncryptedCookie(ctx, loginErrorCookieName, err.Error(), 60); err != nil {
+	if err := hs.trySetEncryptedCookie(ctx, loginErrorCookieName, getLoginExternalError(err), 60); err != nil {
 		hs.log.Error("Failed to set encrypted cookie", "err", err)
 	}
 
 	return response.Redirect(setting.AppSubUrl + "/login")
 }
+
+func getLoginExternalError(err error) string {
+	var createTokenErr *models.CreateTokenErr
+	if errors.As(err, &createTokenErr) {
+		return createTokenErr.ExternalErr
+	}
+
+	return err.Error()
+}
diff --git a/pkg/models/user_token.go b/pkg/models/user_token.go
index fec4ee18112..3cba9ad4595 100644
--- a/pkg/models/user_token.go
+++ b/pkg/models/user_token.go
@@ -11,6 +11,20 @@ var (
 	ErrUserTokenNotFound = errors.New("user token not found")
 )
 
+// CreateTokenErr represents a token creation error; used in Enterprise
+type CreateTokenErr struct {
+	StatusCode  int
+	InternalErr error
+	ExternalErr string
+}
+
+func (e *CreateTokenErr) Error() string {
+	if e.InternalErr != nil {
+		return e.InternalErr.Error()
+	}
+	return "failed to create token"
+}
+
 type TokenExpiredError struct {
 	UserID  int64
 	TokenID int64