1.0.38

src/lib/server/auth.ts

@@ -66,7 +66,8 @@ const EMPTY_PERMISSIONS: Permissions = {
 	license: [],
 	audit_logs: [],
 	activity: [],
-	schedules: []
+	schedules: [],
+	backups: []
 };
 
 /**
@@ -360,7 +361,8 @@ export async function getUserPermissionsById(userId: number): Promise<Permission
 		license: [],
 		audit_logs: [],
 		activity: [],
-		schedules: []
+		schedules: [],
+		backups: []
 	};
 
 	for (const ur of userRoles) {
@@ -441,7 +443,8 @@ export async function getUserPermissionsForEnvironment(userId: number, environme
 		license: [],
 		audit_logs: [],
 		activity: [],
-		schedules: []
+		schedules: [],
+		backups: []
 	};
 
 	for (const ur of userRoles) {
@@ -1221,7 +1224,20 @@ async function getOidcDiscovery(issuerUrl: string): Promise<OidcDiscoveryDocumen
 		? `${issuerUrl}.well-known/openid-configuration`
 		: `${issuerUrl}/.well-known/openid-configuration`;
 
-	const response = await fetch(wellKnownUrl);
+	let response: Response;
+	try {
+		response = await fetch(wellKnownUrl);
+	} catch (err: any) {
+		// Node/undici surfaces network failures as a bare "fetch failed" TypeError and
+		// hides the real reason in err.cause (ENOTFOUND, EHOSTUNREACH, ECONNREFUSED,
+		// connect timeout, TLS error, …). Surface it so operators can tell a DNS/IPv4
+		// egress problem from a cert problem instead of debugging blind (#1293).
+		const cause = err?.cause?.message || err?.cause?.code || err?.cause;
+		throw new Error(
+			`Failed to reach OIDC issuer at ${wellKnownUrl}: ${err?.message || err}` +
+			(cause ? ` (${cause})` : '')
+		);
+	}
 	if (!response.ok) {
 		throw new Error(`Failed to fetch OIDC discovery document: ${response.statusText}`);
 	}