.NET SDK throws exception when GetCheckAsync returns allowed: false

[christiansurges]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Cloud project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

When using GetCheckAsync of the .NET Keto SDK, an exception is thrown for requests that are not allowed.

Reproducing the bug

I have created a repository to reproduce this behavior. Github Repository

1. clone repository
2. start docker containers
   docker-compose up -d
3. start .NET api
   dotnet run
4. open webbrowser api swagger url (you may need to change the port)
5. on swagger hit the CreateExampleRelationTuple endpoint to create an example RealationTuple (or call endpoint directly via endpoint)
6. use GetCheckAsyncSuccess for an working success example(or call endpoint directly via endpoint)
7. use GetCheckAsyncFailure for an example with an exception(or call endpoint directly via endpoint)
8. use GetCheckAsyncWorkaround for an workaround (or call endpoint directly via endpoint)

Relevant log output

No response

Relevant configuration

No response

Version

oryd/keto:v0.8.0

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Docker Compose

Additional Context

No response

[zepatrik]

Thanks for this. As pointed out previously, the status code in case of a false check response is set to 401 on purpose to allow easy integration with other services. Maybe @aeneasr has an idea on how this can be improved in the SDKs? Maybe we can add a second simple endpoint that does not set the status code?
This likely also affects other SDKs.

Current workaround: catch the 401 exception and treat it as a not allowed response.

[aeneasr]

I believe that error status codes (400,500,..) will always return an error response in OpenAPI generated clients. You can type those for better assertiveness, but it will still throw an error!

[zepatrik]

It is not an error message, it is a legit response:

keto/internal/check/handler.go

Lines 160 to 165 in ef103eb

	if allowed {
	h.d.Writer().WriteCode(w, r, http.StatusOK, &RESTResponse{Allowed: true})
	return
	}
	h.d.Writer().WriteCode(w, r, http.StatusForbidden, &RESTResponse{Allowed: false})

[aeneasr]

Sorry, I meant error status codes. So everything >= 400

[zepatrik]

Yes, that is why we should not return an error status code for the SDKs. Not sure what options we have to do that. Do the SDKs set a specific user agent? Or should we add a second route? We could also make it depend on a query parameter.

[aeneasr]

I'd suggest to make this as explicit. Interpreting 200 as "ok this passed" even though it didnt due to some obscure User-Agent behavior or other "auto-detect" feature (even query string) would be quite bad. Actually, I think we need to choose for this endpoint whether to walk back and go with the 200 route again.

[zepatrik]

OK so having two endpoints makes more sense right?