Skip to content

Authorization Service Errors

consortium.server.exceptions.service_exceptions.authorization_service_exceptions

Exception hierarchy:

AuthorizationServiceError(message='', detail=None)

Bases: BaseServiceError

Base exception for all errors that occur within the authorization service.

Attributes:

Name Type Description
code

A stable machine-readable string identifying the specific error.
message str

A human-readable description of what went wrong and, where possible, how to resolve it.
detail dict[str, JsonValue] | None

Optional structured context about the error, or None when there is none.

code = 'AUTHORIZATION_SERVICE_ERROR' class-attribute instance-attribute

RolePermissionsFileError(message='', detail=None)

Bases: AuthorizationServiceError

Base exception for every failure to get the role permissions file's data on or off disk.

Catch this to handle "the role permissions did not make it in or out" without caring why. To distinguish a filesystem fault from a bad file, catch RolePermissionsFileSystemError or RolePermissionsFileContentError instead.

code = 'ROLE_PERMISSIONS_FILE_ERROR' class-attribute instance-attribute

RolePermissionsFileSystemError(operation, path, underlying_error)

Bases: RolePermissionsFileError

Raised when the role permissions file cannot be read from or written to disk.

This covers every way the filesystem can refuse the operation: the file does not exist, the process lacks the required permissions, the configured path points at a directory, the disk is full. They share one type because no caller can act differently on any of them. All of them mean the operation did not happen, and the specific cause is carried in message and detail for whoever has to fix it.

Collapsing every filesystem fault into one type matters more here than elsewhere in the framework. PermissionError is a builtin OSError subclass, and this service's entire domain is authorization permissions, so a raw, unwrapped PermissionError reads to a caller as an authorization decision (a role lacking a permission) rather than what it actually is (the OS denying access to the file on disk). Routing every filesystem failure, including PermissionError, through this single named type removes that ambiguity: a caller that sees RolePermissionsFileSystemError knows immediately the failure is about the file, not about a role's permissions.

A file the filesystem hands over successfully but whose contents are wrong is reported separately, through RolePermissionsFileContentError.

code = 'ROLE_PERMISSIONS_FILE_SYSTEM_ERROR' class-attribute instance-attribute

RolePermissionsFileContentError(message='', detail=None)

Bases: RolePermissionsFileError

Base exception for all errors that occur when a role permissions file's contents are wrong.

The filesystem handed the file's bytes over successfully, so this is fixed by correcting the file rather than by changing the state of the machine or the configured path.

code = 'ROLE_PERMISSIONS_FILE_CONTENT_ERROR' class-attribute instance-attribute

RolePermissionsFileEncodingError(path, underlying_error)

Bases: RolePermissionsFileContentError

Raised when a role permissions file's bytes cannot be decoded as UTF-8.

code = 'ROLE_PERMISSIONS_FILE_ENCODING_ERROR' class-attribute instance-attribute

RolePermissionsFileJSONError(path)

Bases: RolePermissionsFileContentError

Raised when a role permissions file cannot be parsed as valid JSON.

code = 'ROLE_PERMISSIONS_FILE_JSON_ERROR' class-attribute instance-attribute

RolePermissionsFileSchemaError(path, json_schema_error_message)

Bases: RolePermissionsFileContentError

Raised when a role permissions file does not conform to the expected JSON schema.

code = 'ROLE_PERMISSIONS_FILE_SCHEMA_ERROR' class-attribute instance-attribute

RolePermissionsFilePermissionValueError(path, role, permission)

Bases: RolePermissionsFileContentError

Raised when a role permissions file contains an unrecognised permission value.

code = 'ROLE_PERMISSIONS_FILE_PERMISSION_VALUE_ERROR' class-attribute instance-attribute

RoleNotFoundError(role)

Bases: AuthorizationServiceError

Raised when the requested role does not exist in the authorization service.

code = 'ROLE_NOT_FOUND_ERROR' class-attribute instance-attribute

RoleAlreadyExistsError(role)

Bases: AuthorizationServiceError

Raised when attempting to create a role that already exists.

code = 'ROLE_ALREADY_EXISTS_ERROR' class-attribute instance-attribute

PermissionNotInRoleError(role, permission)

Bases: AuthorizationServiceError

Raised when the requested permission is not assigned to the specified role.

code = 'PERMISSION_NOT_IN_ROLE_ERROR' class-attribute instance-attribute

PermissionAlreadyInRoleError(role, permission)

Bases: AuthorizationServiceError

Raised when attempting to add a permission that is already assigned to the role.

code = 'PERMISSION_ALREADY_IN_ROLE_ERROR' class-attribute instance-attribute