Return XML formatted error messages

trino-aws-proxy/src/main/java/io/trino/aws/proxy/server/TrinoAwsProxyServerModule.java

@@ -38,6 +38,7 @@
 import io.trino.aws.proxy.server.rest.RequestFilter;
 import io.trino.aws.proxy.server.rest.RequestLoggerController;
 import io.trino.aws.proxy.server.rest.S3PresignController;
+import io.trino.aws.proxy.server.rest.ThrowableMapper;
 import io.trino.aws.proxy.server.rest.TrinoLogsResource;
 import io.trino.aws.proxy.server.rest.TrinoS3ProxyClient;
 import io.trino.aws.proxy.server.rest.TrinoS3ProxyClient.ForProxyClient;
@@ -90,6 +91,7 @@ protected void setup(Binder binder)
         MapBinder<Class<?>, SigningServiceType> signingServiceTypesMapBinder = newMapBinder(binder, new TypeLiteral<>() {}, new TypeLiteral<>() {});
 
         jaxrsBinder.bind(RequestFilter.class);
+        jaxrsBinder.bind(ThrowableMapper.class);
         bindResourceAtPath(jaxrsBinder, signingServiceTypesMapBinder, SigningServiceType.S3, TrinoS3Resource.class, builtConfig.getS3Path());
         bindResourceAtPath(jaxrsBinder, signingServiceTypesMapBinder, SigningServiceType.STS, TrinoStsResource.class, builtConfig.getStsPath());
         bindResourceAtPath(jaxrsBinder, signingServiceTypesMapBinder, SigningServiceType.LOGS, TrinoLogsResource.class, builtConfig.getLogsPath());

trino-aws-proxy/src/main/java/io/trino/aws/proxy/server/rest/ErrorResponse.java

@@ -0,0 +1,27 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.trino.aws.proxy.server.rest;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "Error")
+public record ErrorResponse(String code, String message, String resource, String requestId)
+{
+    public ErrorResponse(String code, String message, String resource)
+    {
+        this(code, message, resource, null);
+    }
+}

trino-aws-proxy/src/main/java/io/trino/aws/proxy/server/rest/RequestFilter.java

@@ -87,25 +87,26 @@ public void filter(ContainerRequestContext requestContext)
             }
 
             Request request = RequestBuilder.fromRequest(containerRequest);
+            containerRequest.setProperty(Request.class.getName(), request);
+
             RequestLoggingSession requestLoggingSession = requestLoggerController.newRequestSession(request, signingServiceType);
             containerRequest.setProperty(RequestLoggingSession.class.getName(), requestLoggingSession);
 
             SigningMetadata signingMetadata;
             try {
                 signingMetadata = signingController.validateAndParseAuthorization(request, signingServiceType);
+                containerRequest.setProperty(SigningMetadata.class.getName(), signingMetadata);
             }
             catch (Exception e) {
                 requestLoggingSession.logException(e);
 
                 switch (Throwables.getRootCause(e)) {
                     case WebApplicationException webApplicationException -> throw webApplicationException;
                     case IOException ioException -> throw ioException;
+                    case RuntimeException runtimeException -> throw runtimeException;
                     default -> throw new RuntimeException(e);
                 }
             }
-
-            containerRequest.setProperty(Request.class.getName(), request);
-            containerRequest.setProperty(SigningMetadata.class.getName(), signingMetadata);
         }
         else {
             log.warn("%s is not a ContainerRequest", requestContext.getRequest().getClass().getName());

trino-aws-proxy/src/main/java/io/trino/aws/proxy/server/rest/ThrowableMapper.java

@@ -0,0 +1,89 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.trino.aws.proxy.server.rest;
+
+import com.fasterxml.jackson.dataformat.xml.XmlMapper;
+import com.google.inject.Inject;
+import io.airlift.http.client.HttpStatus;
+import io.airlift.log.Logger;
+import io.trino.aws.proxy.spi.rest.Request;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.container.ResourceContext;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
+import jakarta.ws.rs.ext.ExceptionMapper;
+import org.glassfish.jersey.server.ContainerRequest;
+
+import java.util.Optional;
+import java.util.UUID;
+
+import static jakarta.ws.rs.core.HttpHeaders.CONTENT_TYPE;
+import static jakarta.ws.rs.core.MediaType.APPLICATION_XML_TYPE;
+import static java.util.Objects.requireNonNull;
+
+public class ThrowableMapper
+        implements ExceptionMapper<Throwable>
+{
+    private static final Logger log = Logger.get(ThrowableMapper.class);
+    private static final String X_AMZ_REQUEST_ID = "x-amz-request-id";
+
+    @Context
+    private ResourceContext resourceContext;
+
+    private final XmlMapper xmlMapper;
+
+    @Inject
+    public ThrowableMapper(XmlMapper xmlMapper)
+    {
+        this.xmlMapper = requireNonNull(xmlMapper, "xmlMapper is null");
+    }
+
+    @Override
+    public Response toResponse(Throwable throwable)
+    {
+        ContainerRequest containerRequest = resourceContext.getResource(ContainerRequest.class);
+        Optional<String> requestId = Optional.ofNullable((Request) containerRequest.getProperty(Request.class.getName()))
+                .map(Request::requestId)
+                .map(UUID::toString);
+
+        HttpStatus status = switch (throwable) {
+            case WebApplicationException webApplicationException -> HttpStatus.fromStatusCode(webApplicationException.getResponse().getStatus());
+            default -> HttpStatus.INTERNAL_SERVER_ERROR;
+        };
+
+        try {
+            log.error(throwable, "Request failed for %s", containerRequest.getRequestUri().getPath());
+
+            ErrorResponse response = requestId
+                    .map(id -> new ErrorResponse(
+                                status.reason(),
+                                throwable.getMessage(),
+                                containerRequest.getRequestUri().getPath(),
+                                id))
+                    .orElse(new ErrorResponse(
+                            status.reason(),
+                            throwable.getMessage(),
+                            containerRequest.getRequestUri().getPath()));
+
+            ResponseBuilder responseBuilder = Response.status(status.code())
+                    .header(CONTENT_TYPE, APPLICATION_XML_TYPE);
+            requestId.ifPresent(id -> responseBuilder.header(X_AMZ_REQUEST_ID, id));
+            return responseBuilder.entity(xmlMapper.writeValueAsString(response)).build();
+        }
+        catch (Exception e) {
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR).build();
+        }
+    }
+}

trino-aws-proxy/src/test/java/io/trino/aws/proxy/server/plugin/exception/TestCredentialsProviderExceptionPropagation.java

@@ -0,0 +1,102 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.trino.aws.proxy.server.plugin.exception;
+
+import com.google.inject.Inject;
+import com.google.inject.Scopes;
+import io.airlift.http.client.HttpStatus;
+import io.trino.aws.proxy.server.testing.TestingTrinoAwsProxyServer.Builder;
+import io.trino.aws.proxy.server.testing.harness.BuilderFilter;
+import io.trino.aws.proxy.server.testing.harness.TrinoAwsProxyTest;
+import io.trino.aws.proxy.spi.credentials.Credentials;
+import io.trino.aws.proxy.spi.credentials.CredentialsProvider;
+import jakarta.ws.rs.WebApplicationException;
+import org.junit.jupiter.api.Test;
+import software.amazon.awssdk.services.s3.S3Client;
+import software.amazon.awssdk.services.s3.model.S3Exception;
+
+import java.util.Optional;
+
+import static io.trino.aws.proxy.spi.plugin.TrinoAwsProxyServerBinding.credentialsProviderModule;
+import static java.util.Objects.requireNonNull;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.InstanceOfAssertFactories.type;
+
+@TrinoAwsProxyTest(filters = TestCredentialsProviderExceptionPropagation.Filter.class)
+public class TestCredentialsProviderExceptionPropagation
+{
+    private final DelegatingCredentialsProvider delegatingCredentialsProvider;
+    private final S3Client internalClient;
+
+    public static class DelegatingCredentialsProvider
+            implements CredentialsProvider
+    {
+        private CredentialsProvider delegate;
+
+        public void setDelegate(CredentialsProvider delegate)
+        {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public Optional<Credentials> credentials(String emulatedAccessKey, Optional<String> session)
+        {
+            return requireNonNull(delegate, "delegate is null").credentials(emulatedAccessKey, session);
+        }
+    }
+
+    public static class Filter
+            implements BuilderFilter
+    {
+        @Override
+        public Builder filter(Builder builder)
+        {
+            return builder.withoutTestingCredentialsRoleProviders()
+                    .addModule(credentialsProviderModule("testing", DelegatingCredentialsProvider.class, binder -> binder.bind(DelegatingCredentialsProvider.class).in(Scopes.SINGLETON)))
+                    .withProperty("credentials-provider.type", "testing");
+        }
+    }
+
+    @Inject
+    public TestCredentialsProviderExceptionPropagation(DelegatingCredentialsProvider delegatingCredentialsProvider, S3Client internalClient)
+    {
+        this.delegatingCredentialsProvider = requireNonNull(delegatingCredentialsProvider, "delegatingCredentialsProvider is null");
+        this.internalClient = requireNonNull(internalClient, "internalClient is null");
+    }
+
+    @Test
+    public void testRuntimeException()
+    {
+        delegatingCredentialsProvider.setDelegate((_, _) -> { throw new RuntimeException("Testing exception"); });
+        assertThatThrownBy(internalClient::listBuckets)
+                .asInstanceOf(type(S3Exception.class))
+                .satisfies(s3Exception -> {
+                    assertThat(s3Exception.statusCode()).isEqualTo(500);
+                    assertThat(s3Exception.awsErrorDetails().errorMessage()).isEqualTo("Testing exception");
+                });
+    }
+
+    @Test
+    public void testWebApplicationException()
+    {
+        delegatingCredentialsProvider.setDelegate((_, _) -> { throw new WebApplicationException("Testing exception", HttpStatus.IM_A_TEAPOT.code()); });
+        assertThatThrownBy(internalClient::listBuckets)
+                .asInstanceOf(type(S3Exception.class))
+                .satisfies(s3Exception -> {
+                    assertThat(s3Exception.statusCode()).isEqualTo(418);
+                    assertThat(s3Exception.awsErrorDetails().errorMessage()).isEqualTo("Testing exception");
+                });
+    }
+}