Improve error message when using the wrong Service Account

[pro-sumer]

Current Behavior

node_modules/@1password/sdk/dist/errors.js:18
        throw new Error(errString);
              ^

Error: data did not match any variant of untagged enum Invocation at line 1 column 152
    at throwError (/Users/rob/Developer/Personal/Trakt/node_modules/@1password/sdk/dist/errors.js:18:15)
    at SharedCore.<anonymous> (/Users/rob/Developer/Personal/Trakt/node_modules/@1password/sdk/dist/core.js:47:41)
    at Generator.throw (<anonymous>)
    at rejected (/Users/rob/Developer/Personal/Trakt/node_modules/@1password/sdk/dist/core.js:6:65)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

Desired Behavior

Error: the Service Account XXX that you are using does not have the correct access rights to work with the vault YYY.

Benefits & Value

It would prevent me spending hours looking in the wrong directions (trying to find non-existing bugs in my code).

Additional information

See discussion on your Slack about this (April 25).

[MOmarMiraj]

Hi @pro-sumer,

Just to be clear, you had a valid service account token in OP_SERVICE_ACCOUNT_TOKEN env variable but it was the incorrect permissions which gave you this error here?

[pro-sumer]

Hi @pro-sumer,

Just to be clear, you had a valid service account token in OP_SERVICE_ACCOUNT_TOKEN env variable but it was the incorrect permissions which gave you this error here?

Yes, it was the token for another Service Account (which has access to a different vault).

[AndyTitu]

@pro-sumer I attempted to reproduce this bug by following the steps that you described:

const sdk = require("@1password/sdk");

async function fetchSecret(vaultId, itemId) {
  const client = await sdk.createClient({
    // wrong service account token - another vault access
    // ➜  examples git:(main) ✗ op vault ls
    // ID                                                          NAME
    // xw33qlvug6moegr3wkk5zkenoa    testingVault
    auth: process.env.OP_SERVICE_ACCOUNT_TOKEN, 
    integrationName: "My 1Password Integration",
    integrationVersion: "v1.0.0",
  });
  return await client.secrets.resolve(
    "op://" + vaultId + "/" + itemId + "/username",
  );
}

// Trying to fetch secret for different vault
fetchSecret("7wnyvknuln2qqscgf7vix5q6ii", "kuoo6jdcaydlvdsar5n7u2teyq").then(console.log);

Returns

 // this failed after the error deserialisation which means sdk-core has been correctly invoked, while your logs show that error deserialisation is failing so the error wasn't returned by sdk core business logic
/Users/andititu/1password-js-sdk/client/dist/errors.js:24
            throw new Error(err.message);
                  ^

Error: error resolving secret reference: no vault matched the secret reference query
    at throwError (/Users/andititu/1password-js-sdk/client/dist/errors.js:24:19)
    at SharedCore.<anonymous> (/Users/andititu/1password-js-sdk/client/dist/core.js:47:41)
    at Generator.throw (<anonymous>)
    at rejected (/Users/andititu/1password-js-sdk/client/dist/core.js:6:65)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

Node.js v20.11.1

I am fairly confident your error is not stemming from the invalid service account token.

Here is how I was able to reproduce your actual error:

I modified my secrets.ts file such that my resolve secret reference function will invoke the sdk core with an invalid hook id:

diff --git a/client/src/secrets.ts b/client/src/secrets.ts
index 4cb66ef..c63a6d6 100644
--- a/client/src/secrets.ts
+++ b/client/src/secrets.ts
@@ -39,7 +39,7 @@ export class Secrets implements SecretsApi {
       invocation: {
         clientId: this.#inner.id,
         parameters: {
-          name: "SecretsResolve",
+          name: "SecretsResolveInvalid", // This will fail irrecoverably due to interface mismatch
           parameters: {
             secret_reference: secretReference,
           }, 

With the same script as above I'm now getting:

/Users/andititu/1password-js-sdk/client/dist/errors.js:18
        throw new Error(errString);
              ^

Error: data did not match any variant of untagged enum Invocation at line 1 column 177
    at throwError (/Users/andititu/1password-js-sdk/client/dist/errors.js:18:15)
    at SharedCore.<anonymous> (/Users/andititu/1password-js-sdk/client/dist/core.js:47:41)
    at Generator.throw (<anonymous>)
    at rejected (/Users/andititu/1password-js-sdk/client/dist/core.js:6:65)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

Node.js v20.11.1

Bingo!

Based on this, I think your error might be related to the following:

• the sdk client src code you are using in your node modules is somehow containing a modification like above - maybe you installed the sdk from source, or someone tampered with your node modules
• you are somehow encountering a version mismatch between the sdk-client package and the sdk-core package (which are 2 different npm packages that are managed and downloaded separately and the SDK needs both to work correctly)

If you could check for the above diagnostics and provide a script of what you were doing when you were encountering the error, it would be awesome!

[pro-sumer]

After removing everything in node_modules and installing dependencies again (using bun install) I still get the error I initially reported, when using the wrong service account token.

This is the only 1Password related entry in my package.json:

  "dependencies": {
    "@1password/sdk": "latest",
    ...
  },

[Marton6]

After removing everything in node_modules and installing dependencies again (using bun install) I still get the error I initially reported, when using the wrong service account token.

This is the only 1Password related entry in my package.json:

  "dependencies": {
    "@1password/sdk": "latest",
    ...
  },

Interesting. Could you check your package-lock.json and let us know what version of @1password/sdk-core and @1password/sdk you see in it?

[pro-sumer]

Unfortunately I have this in my .bunfig.toml:

[install.lockfile]
save = false

However, I went into the node_modules/@1password folder and did this:

➜ grep version */package.json
sdk-core/package.json:  "version": "0.3.0",
sdk/package.json:  "version": "0.3.0",

That's OK I think?