Move Error logic out of botbuilder into authentication layer

libraries/botbuilder-core/src/index.ts

@@ -39,7 +39,6 @@ export {
     SkillConversationReferenceKey,
     SkillConversationIdFactoryOptions } from './skills';
 export * from './skypeMentionNormalizeMiddleware';
-export * from './statusCodes';
 export * from './storage';
 export * from './telemetryLoggerMiddleware';
 export * from './testAdapter';

libraries/botbuilder/src/botFrameworkAdapter.ts

@@ -9,8 +9,8 @@
 import { STATUS_CODES } from 'http';
 import { arch, release, type } from 'os';
 
-import { Activity, ActivityTypes, CoreAppCredentials, BotAdapter, BotCallbackHandlerKey, CallerIdConstants, ChannelAccount, ConversationAccount, ConversationParameters, ConversationReference, ConversationsResult, DeliveryModes, ExpectedReplies, InvokeResponse, ExtendedUserTokenProvider, ResourceResponse, StatusCodes, TokenResponse, TurnContext, INVOKE_RESPONSE_KEY } from 'botbuilder-core';
-import { AuthenticationConfiguration, AuthenticationConstants, ChannelValidation, Claim, ClaimsIdentity, ConnectorClient, EmulatorApiClient, GovernmentConstants, GovernmentChannelValidation, JwtTokenValidation, MicrosoftAppCredentials, AppCredentials, CertificateAppCredentials, SimpleCredentialProvider, TokenApiClient, TokenStatus, TokenApiModels, SignInUrlResponse, SkillValidation, TokenExchangeRequest } from 'botframework-connector';
+import { Activity, ActivityTypes, CallerIdConstants, CoreAppCredentials, BotAdapter, BotCallbackHandlerKey, ChannelAccount, ConversationAccount, ConversationParameters, ConversationReference, ConversationsResult, DeliveryModes, ExpectedReplies, ExtendedUserTokenProvider, InvokeResponse, INVOKE_RESPONSE_KEY, IStatusCodeError, ResourceResponse, StatusCodes, TokenResponse, TurnContext } from 'botbuilder-core';
+import { AuthenticationConfiguration, AuthenticationConstants, ChannelValidation, Claim, ClaimsIdentity, ConnectorClient, EmulatorApiClient, GovernmentConstants, GovernmentChannelValidation, JwtTokenValidation, MicrosoftAppCredentials, AppCredentials, CertificateAppCredentials, SimpleCredentialProvider, TokenApiClient, TokenStatus, TokenApiModels, SignInUrlResponse, SkillValidation, TokenExchangeRequest, AuthenticationError } from 'botframework-connector';
 
 import { INodeBuffer, INodeSocket, IReceiveRequest, ISocket, IStreamingTransportServer, NamedPipeServer, NodeWebSocketFactory, NodeWebSocketFactoryBase, RequestHandler, StreamingResponse, WebSocketServer } from 'botframework-streaming';
 
@@ -1378,21 +1378,7 @@ export class BotFrameworkAdapter extends BotAdapter implements ExtendedUserToken
         try {
             await this.authenticateConnection(req, this.settings.channelService);
         } catch (err) {
-            // If the authenticateConnection call fails, send back the correct error code and close
-            // the connection.
-            if (typeof(err.message) === 'string') {
-                if (err.message.toLowerCase().startsWith('unauthorized')) {
-                    abortWebSocketUpgrade(socket, 401, err.message);
-                } else if (err.message.toLowerCase().startsWith(`'authheader'`)) {
-                    abortWebSocketUpgrade(socket, 400, err.message);
-                } else {
-                    abortWebSocketUpgrade(socket, 500, err.message);
-                }
-            } else {
-                abortWebSocketUpgrade(socket, 500);
-            }
-
-            // Re-throw the error so the developer will know what occurred.
+            abortWebSocketUpgrade(socket, err);
             throw err;
         }
 
@@ -1416,7 +1402,9 @@ export class BotFrameworkAdapter extends BotAdapter implements ExtendedUserToken
         const serviceUrl = claims.getClaimValue(AuthenticationConstants.ServiceUrlClaim);
         AppCredentials.trustServiceUrl(serviceUrl);
 
-        if (!claims.isAuthenticated) { throw new Error('Unauthorized Access. Request is not authorized'); }
+        if (!claims.isAuthenticated) { 
+            throw new AuthenticationError('Unauthorized Access. Request is not authorized', StatusCodes.UNAUTHORIZED); 
+        }
     }
 
     /**
@@ -1516,11 +1504,22 @@ function delay(timeout: number): Promise<void> {
     });
 }
 
-function abortWebSocketUpgrade(socket: INodeSocket, code: number, message?: string): void {
+/**
+* Creates an error message with status code to write to socket, then closes the connection.
+* 
+* @param socket The raw socket connection between the bot (server) and channel/caller (client).
+* @param err The error. If the error includes a status code, it will be included in the message written to the socket.
+*/
+function abortWebSocketUpgrade(socket: INodeSocket, err: any): void {
     if (socket.writable) {
         const connectionHeader = `Connection: 'close'\r\n`;
-        socket.write(`HTTP/1.1 ${ code } ${ STATUS_CODES[code] }\r\n${ message }\r\n${ connectionHeader }\r\n`);
-    }
 
+        let message = '';
+        AuthenticationError.isStatusCodeError(err) ? 
+            message = `HTTP/1.1 ${ err.statusCode } ${ StatusCodes[err.statusCode] }\r\n${ err.message }\r\n${ connectionHeader }\r\n`
+            : message = AuthenticationError.determineStatusCodeAndBuildMessage(err);
+
+        socket.write(message);
+    }
     socket.destroy();
 }

libraries/botbuilder/tests/streaming/botFrameworkAdapterStreaming.test.js

@@ -123,6 +123,7 @@ describe('BotFrameworkAdapter Streaming tests', () => {
                     await bot.run(context);
                 });
             } catch (err) {
+                expect(err.statusCode).to.equal(401);
                 expect(err.message).to.equal('Unauthorized. No valid identity.');
                 const socketResponse = MockNetSocket.createNonSuccessResponse(401, err.message);
                 expect(writeSpy.called).to.be.true;
@@ -147,19 +148,14 @@ describe('BotFrameworkAdapter Streaming tests', () => {
                 });
             } catch (err) {
                 expect(err.message).to.equal("'authHeader' required.");
+                expect(err.statusCode).to.equal(400);
                 const socketResponse = MockNetSocket.createNonSuccessResponse(400, err.message);
                 expect(writeSpy.called).to.be.true;
                 expect(writeSpy.calledWithExactly(socketResponse)).to.be.true;
                 expect(destroySpy.calledOnceWithExactly()).to.be.true;
             };
         });
 
-        try {
-
-        } catch (error) {
-
-        }
-
         it('returns status code 500 when request logic is not callable', async () => {
             const adapter = new BotFrameworkAdapter(new TestAdapterSettings());
             const request = new MockHttpRequest();

libraries/botbuilder/tests/streaming/mockNetSocket.js

@@ -1,4 +1,5 @@
 const { STATUS_CODES } = require('http');
+const { AuthenticationError, StatusCodes } = require('botbuilder-core');
 
 class MockNetSocket {
     constructor(readable = true, writable = true) {
@@ -12,7 +13,8 @@ class MockNetSocket {
 }
 
 MockNetSocket.createNonSuccessResponse = (code, message) => {
-    return `HTTP/1.1 ${code} ${STATUS_CODES[code]}\r\n${message}\r\nConnection: 'close'\r\n\r\n`;
+    return `HTTP/1.1 ${code} ${StatusCodes[code]}\r\n${message}\r\nConnection: 'close'\r\n\r\n`;
 };
 
+
 module.exports.MockNetSocket = MockNetSocket;

libraries/botframework-connector/src/auth/authenticationError.ts

@@ -0,0 +1,44 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import { IStatusCodeError, StatusCodes } from 'botframework-schema';
+
+export type StatusCode = number;
+
+export class AuthenticationError extends Error implements IStatusCodeError {
+    constructor(
+        message: string,
+        public readonly statusCode: StatusCode
+    ) {
+        super(message);
+    }
+
+    public static isStatusCodeError(err: any): err is IStatusCodeError {
+        return !!(err && err.statusCode && typeof err.statusCode === "number");
+    }
+
+    /**
+     * Used to determine a status code from the error message for non-`IStatusCodeError`'s.
+     * @param err The error thrown, used to determine an appropriate status code.
+     */
+    public static determineStatusCodeAndBuildMessage(err: any): string {
+        let errMessage: string = (err && err.message) ? err.message : 'Internal Server Error';
+        let code: number = AuthenticationError.determineStatusCode(errMessage);
+        const connectionHeader = `Connection: 'close'\r\n`;
+
+        return `HTTP/1.1 ${ code } ${ StatusCodes[code] }\r\n${ errMessage }\r\n${ connectionHeader }\r\n`;
+    }
+
+    private static determineStatusCode(message: string): StatusCode {
+        if (typeof(message) === 'string') {
+            if (message.toLowerCase().startsWith('unauthorized')) {
+                return 401;
+            } else if (message.toLowerCase().startsWith(`'authheader'`)) {
+                return 400;
+            } 
+        }
+        return 500;
+    }
+
+}

libraries/botframework-connector/src/auth/channelValidation.ts

@@ -11,6 +11,8 @@ import { AuthenticationConfiguration } from './authenticationConfiguration';
 import { ClaimsIdentity } from './claimsIdentity';
 import { ICredentialProvider } from './credentialProvider';
 import { JwtTokenExtractor } from './jwtTokenExtractor';
+import { AuthenticationError } from './authenticationError';
+import { StatusCodes } from 'botframework-schema';
 
 export namespace ChannelValidation {
 
@@ -49,7 +51,7 @@ export namespace ChannelValidation {
         const serviceUrlClaim: string = identity.getClaimValue(AuthenticationConstants.ServiceUrlClaim);
         if (serviceUrlClaim !== serviceUrl) {
             // Claim must match. Not Authorized.
-            throw new Error('Unauthorized. ServiceUrl claim do not match.');
+            throw new AuthenticationError('Unauthorized. ServiceUrl claim do not match.', StatusCodes.UNAUTHORIZED);
         }
 
         return identity;
@@ -93,7 +95,7 @@ export namespace ChannelValidation {
     ): Promise<ClaimsIdentity> {
         if (!identity || !identity.isAuthenticated) {
             // The token is in some way invalid. Not Authorized.
-            throw new Error('Unauthorized. Is not authenticated');
+            throw new AuthenticationError('Unauthorized. Is not authenticated', StatusCodes.UNAUTHORIZED);
         }
 
         // Now check that the AppID in the claimset matches
@@ -104,15 +106,15 @@ export namespace ChannelValidation {
         // Look for the "aud" claim, but only if issued from the Bot Framework
         if (identity.getClaimValue(AuthenticationConstants.IssuerClaim) !== AuthenticationConstants.ToBotFromChannelTokenIssuer) {
             // The relevant Audiance Claim MUST be present. Not Authorized.
-            throw new Error('Unauthorized. Issuer Claim MUST be present.');
+            throw new AuthenticationError('Unauthorized. Issuer Claim MUST be present.', StatusCodes.UNAUTHORIZED);
         }
 
         // The AppId from the claim in the token must match the AppId specified by the developer.
         // In this case, the token is destined for the app, so we find the app ID in the audience claim.
         const audClaim: string = identity.getClaimValue(AuthenticationConstants.AudienceClaim);
         if (!(await credentials.isValidAppId(audClaim || ''))) {
             // The AppId is not valid or not present. Not Authorized.
-            throw new Error(`Unauthorized. Invalid AppId passed on token: ${ audClaim }`);
+            throw new AuthenticationError(`Unauthorized. Invalid AppId passed on token: ${ audClaim }`, StatusCodes.UNAUTHORIZED);
         }
 
         return identity;

libraries/botframework-connector/src/auth/emulatorValidation.ts

@@ -13,6 +13,8 @@ import { GovernmentConstants } from './governmentConstants';
 import { ICredentialProvider } from './credentialProvider';
 import { JwtTokenExtractor } from './jwtTokenExtractor';
 import { JwtTokenValidation } from './jwtTokenValidation';
+import { AuthenticationError } from './authenticationError';
+import { StatusCodes } from 'botframework-schema';
 
 /**
  * Validates and Examines JWT tokens from the Bot Framework Emulator
@@ -119,12 +121,12 @@ export namespace EmulatorValidation {
         const identity: ClaimsIdentity = await tokenExtractor.getIdentityFromAuthHeader(authHeader, channelId, authConfig.requiredEndorsements);
         if (!identity) {
             // No valid identity. Not Authorized.
-            throw new Error('Unauthorized. No valid identity.');
+            throw new AuthenticationError('Unauthorized. No valid identity.', StatusCodes.UNAUTHORIZED);
         }
 
         if (!identity.isAuthenticated) {
             // The token is in some way invalid. Not Authorized.
-            throw new Error('Unauthorized. Is not authenticated');
+            throw new AuthenticationError('Unauthorized. Is not authenticated', StatusCodes.UNAUTHORIZED);
         }
 
         // Now check that the AppID in the claimset matches
@@ -133,7 +135,7 @@ export namespace EmulatorValidation {
         // Async validation.
         const versionClaim: string = identity.getClaimValue(AuthenticationConstants.VersionClaim);
         if (versionClaim === null) {
-            throw new Error('Unauthorized. "ver" claim is required on Emulator Tokens.');
+            throw new AuthenticationError('Unauthorized. "ver" claim is required on Emulator Tokens.', StatusCodes.UNAUTHORIZED);
         }
 
         let appId = '';
@@ -146,7 +148,7 @@ export namespace EmulatorValidation {
             const appIdClaim: string = identity.getClaimValue(AuthenticationConstants.AppIdClaim);
             if (!appIdClaim) {
                 // No claim around AppID. Not Authorized.
-                throw new Error('Unauthorized. "appid" claim is required on Emulator Token version "1.0".');
+                throw new AuthenticationError('Unauthorized. "appid" claim is required on Emulator Token version "1.0".', StatusCodes.UNAUTHORIZED);
             }
 
             appId = appIdClaim;
@@ -155,17 +157,17 @@ export namespace EmulatorValidation {
             const appZClaim: string = identity.getClaimValue(AuthenticationConstants.AuthorizedParty);
             if (!appZClaim) {
                 // No claim around AppID. Not Authorized.
-                throw new Error('Unauthorized. "azp" claim is required on Emulator Token version "2.0".');
+                throw new AuthenticationError('Unauthorized. "azp" claim is required on Emulator Token version "2.0".', StatusCodes.UNAUTHORIZED);
             }
 
             appId = appZClaim;
         } else {
             // Unknown Version. Not Authorized.
-            throw new Error(`Unauthorized. Unknown Emulator Token version "${ versionClaim }".`);
+            throw new AuthenticationError(`Unauthorized. Unknown Emulator Token version "${ versionClaim }".`, StatusCodes.UNAUTHORIZED);
         }
 
         if (!await credentials.isValidAppId(appId)) {
-            throw new Error(`Unauthorized. Invalid AppId passed on token: ${ appId }`);
+            throw new AuthenticationError(`Unauthorized. Invalid AppId passed on token: ${ appId }`, StatusCodes.UNAUTHORIZED);
         }
 
         return identity;

libraries/botframework-connector/src/auth/endorsementsValidator.ts

@@ -1,6 +1,10 @@
 /**
  * @module botbuilder
  */
+
+import { AuthenticationError } from "./authenticationError";
+import { StatusCodes } from "botframework-schema";
+
 /**
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -24,7 +28,7 @@ export class EndorsementsValidator {
         }
 
         if (endorsements === null) {
-            throw new Error('endorsements required');
+            throw new AuthenticationError('endorsements required', StatusCodes.BAD_REQUEST);
         }
 
         // The Call path to get here is:

libraries/botframework-connector/src/auth/enterpriseChannelValidation.ts

@@ -12,6 +12,8 @@ import { ChannelValidation } from './channelValidation';
 import { ClaimsIdentity } from './claimsIdentity';
 import { ICredentialProvider } from './credentialProvider';
 import { JwtTokenExtractor } from './jwtTokenExtractor';
+import { AuthenticationError } from './authenticationError';
+import { StatusCodes } from 'botframework-schema';
 
 export namespace EnterpriseChannelValidation {
 
@@ -46,7 +48,7 @@ export namespace EnterpriseChannelValidation {
         const serviceUrlClaim: string = identity.getClaimValue(AuthenticationConstants.ServiceUrlClaim);
         if (serviceUrlClaim !== serviceUrl) {
             // Claim must match. Not Authorized.
-            throw new Error('Unauthorized. ServiceUrl claim do not match.');
+            throw new AuthenticationError('Unauthorized. ServiceUrl claim do not match.', StatusCodes.UNAUTHORIZED);
         }
 
         return identity;
@@ -92,12 +94,12 @@ export namespace EnterpriseChannelValidation {
 
         if (!identity) {
             // No valid identity. Not Authorized.
-            throw new Error('Unauthorized. No valid identity.');
+            throw new AuthenticationError('Unauthorized. No valid identity.', StatusCodes.UNAUTHORIZED);
         }
 
         if (!identity.isAuthenticated) {
             // The token is in some way invalid. Not Authorized.
-            throw new Error('Unauthorized. Is not authenticated');
+            throw new AuthenticationError('Unauthorized. Is not authenticated', StatusCodes.UNAUTHORIZED);
         }
 
         // Now check that the AppID in the claimset matches
@@ -108,15 +110,15 @@ export namespace EnterpriseChannelValidation {
         // Look for the "aud" claim, but only if issued from the Bot Framework
         if (identity.getClaimValue(AuthenticationConstants.IssuerClaim) !== AuthenticationConstants.ToBotFromChannelTokenIssuer) {
             // The relevant Audiance Claim MUST be present. Not Authorized.
-            throw new Error('Unauthorized. Issuer Claim MUST be present.');
+            throw new AuthenticationError('Unauthorized. Issuer Claim MUST be present.', StatusCodes.UNAUTHORIZED);
         }
 
         // The AppId from the claim in the token must match the AppId specified by the developer.
         // In this case, the token is destined for the app, so we find the app ID in the audience claim.
         const audClaim: string = identity.getClaimValue(AuthenticationConstants.AudienceClaim);
         if (!(await credentials.isValidAppId(audClaim || ''))) {
             // The AppId is not valid or not present. Not Authorized.
-            throw new Error(`Unauthorized. Invalid AppId passed on token: ${ audClaim }`);
+            throw new AuthenticationError(`Unauthorized. Invalid AppId passed on token: ${ audClaim }`, StatusCodes.UNAUTHORIZED);
         }
 
         return identity;