[Bug] /api/v1/<user.ID>/key returns 401/403 if user hasn't key

[nikoIkonen]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	Stretch
Virtualized Env.	True
Dedicated RAM	6 GB
vCPU	4
TheHive version / git hash	4.1.4-1
Package Type	DEB,
Database	Cassandra
Index type	Lucene
Attachments storage	Local
Browser type & version	not applicable

Problem Description

When calling API endpoint /api/v1/user//key as admin when userID does NOT have key created, will return error code 401 or 403 and not expected 404. Endpoint works correctly when api key has been generated.

Steps to Reproduce

1. Create a new user to organization, don't create a API key.
2. Call API to get KEY, curl -k -H 'Authorization: Bearer <adminApiKey>' https://localhost/api/v1/user/<userID>/key
3. Get HTTP 401/403 See another issue 2070
4. Get correct error message in thehive application.log "User hasn't key"

Complementary information

To me it seems like getKey returns failure and it is then interpreted as failure in authentication.

Excerpt from the application.log:
2021-06-08 16:20:19,452 [WARN] from org.thp.thehive.services.TOTPAuthSrv in application-akka.actor.default-dispatcher-12 [00000005|] session fails: org.thp.scalligraph.AuthorizationError: Operation not supported
2021-06-08 16:20:19,452 [WARN] from org.thp.thehive.services.TOTPAuthSrv in application-akka.actor.default-dispatcher-12 [00000005|] basic fails: org.thp.scalligraph.AuthorizationError: Operation not supported
2021-06-08 16:20:19,452 [WARN] from org.thp.thehive.services.TOTPAuthSrv in application-akka.actor.default-dispatcher-12 [00000005|] local fails: org.thp.scalligraph.AuthorizationError: Operation not supported
2021-06-08 16:20:19,452 [WARN] from org.thp.thehive.services.TOTPAuthSrv in application-akka.actor.default-dispatcher-12 [00000005|] key fails: org.thp.scalligraph.NotFoundError: User userID hasn't key
2021-06-08 16:20:19,452 [WARN] from org.thp.scalligraph.ErrorHandler in application-akka.actor.default-dispatcher-12 [00000005|] GET /api/v1/user/~16432/key returned 403