[alko89]

PR Checklist

Please check if your PR fulfills the following requirements:

• The commit message follows our guidelines: https://github.com/nestjs/nest/blob/master/CONTRIBUTING.md
• Tests for the changes have been updated (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Other... Please describe:

What is the current behavior?

Authorization denial payloads omitted errorCode.

What is the new behavior?

Include the denial reason as errorCode for exceptions.

{ "message": "Forbidden", "statusCode": 403, "errorCode": "forbidden" }

Does this PR introduce a breaking change?

• Yes
• No

[kamilmysliwiec]

Thanks for the PR! Closing, though: errorCode here only repeats the status code. unauthenticated is always 401 and forbidden is always 403, and GraphQL already exposes the same thing as extensions.code. Adding the field would also change every denial body (a breaking change for clients that match the exact body), and our 401s would no longer match the ones from the authentication guard.

A code would only help if it told apart denials that share a status, like which policy or ability denied. That's deliberately kept out of the response (it's on cause, for logs). If you need app-specific codes, an exception filter in your app can add them from cause.

[alko89]

Thanks! Yes I was aware that the errorCode repeats the current message, although in lowercase. My though was that authentication package does include error codes, it would make sense for consistency (at least some default value).

I started a new API recently with using Nest 12 and do take advantage error codes. I'll add an exception filter myself to include them.