From 038a9eb03a3043e4ee418a8b24a8769c37c82006 Mon Sep 17 00:00:00 2001
From: Drew DeVault <drew@ddevault.org>
Date: Wed, 8 Oct 2025 11:12:19 +0200
Subject: [PATCH] auth: add error code on unauthorized request response

---
 auth/middleware.go | 21 ++++++++++-----------
 errors/errors.go   |  2 ++
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/auth/middleware.go b/auth/middleware.go
index 7eb839e98c85c06270567ab9669862e9bead63d7..74d44aa48d0d914e9d78bff0429f659caf803675 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -6,7 +6,6 @@ import (
 	"database/sql"
 	"encoding/hex"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"log"
 	"net"
@@ -24,6 +23,7 @@ import (
 	"git.sr.ht/~sircmpwn/core-go/config"
 	"git.sr.ht/~sircmpwn/core-go/crypto"
 	"git.sr.ht/~sircmpwn/core-go/database"
+	"git.sr.ht/~sircmpwn/core-go/errors"
 )
 
 var userCtxKey = &contextKey{"user"}
@@ -87,12 +87,12 @@ func (authctx *AuthContext) Access(scope, kind string) error {
 		return nil
 	case AUTH_WEBHOOK:
 		if kind != RO {
-			return fmt.Errorf("Access to read/write resolver denied for webhook")
+			return errors.Errorf(errors.AccessDenied, "Access to read/write resolver denied for webhook")
 		}
 		fallthrough
 	case AUTH_OAUTH2:
 		if !authctx.Grants.Has(scope, kind) {
-			return fmt.Errorf("Access denied, missing %v:%v grant", scope, kind)
+			return errors.Errorf(errors.AccessDenied, "Access denied, missing %v:%v grant", scope, kind)
 		}
 		return nil
 	default:
@@ -156,7 +156,7 @@ func authForOAuthClient(ctx context.Context, clientUUID string) (*AuthContext, e
 			if err := rows.Err(); err != nil {
 				panic(err)
 			}
-			return fmt.Errorf("Authenticating for unknown client ID %s", clientUUID)
+			return errors.Errorf(errors.Unauthorized, "Authenticating for unknown client ID %s", clientUUID)
 		}
 		if err := rows.Scan(&auth.UserID, &auth.Username, &auth.Created,
 			&auth.Updated, &auth.Email, &auth.UserType, &auth.URL, &auth.Location,
@@ -168,7 +168,7 @@ func authForOAuthClient(ctx context.Context, clientUUID string) (*AuthContext, e
 			if err := rows.Err(); err != nil {
 				panic(err)
 			}
-			panic(errors.New("Multiple matching user accounts; invariant broken"))
+			panic(fmt.Errorf("Multiple matching user accounts; invariant broken"))
 		}
 		return nil
 	}); err != nil {
@@ -315,7 +315,7 @@ func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next h
 
 func FetchMetaProfile(ctx context.Context, username string, user *AuthContext) error {
 	if config.ServiceName(ctx) == "meta.sr.ht" {
-		panic(errors.New("Cannot fetch profile from ourselves"))
+		panic(fmt.Errorf("Cannot fetch profile from ourselves"))
 	}
 
 	query := client.GraphQLQuery{
@@ -392,7 +392,7 @@ func FetchMetaProfile(ctx context.Context, username string, user *AuthContext) e
 			&user.Username, &user.Email, &user.UserType, &user.URL,
 			&user.Location, &user.Bio, &user.SuspensionNotice); err != nil {
 			if err == sql.ErrNoRows {
-				panic(errors.New("Failed to upsert user record from meta.sr.ht"))
+				panic(fmt.Errorf("Failed to upsert user record from meta.sr.ht"))
 			}
 			return err
 		}
@@ -435,8 +435,7 @@ func LookupUser(ctx context.Context, username string, user *AuthContext) error {
 				return err
 			}
 			if config.ServiceName(ctx) == "meta.sr.ht" {
-				log.Printf("LookupUser: Unknown user %s", username)
-				return fmt.Errorf("Unknown user %s", username)
+				return errors.Errorf(errors.Unauthorized, "Unknown user %s", username)
 			}
 			return FetchMetaProfile(ctx, username, user)
 		}
@@ -460,7 +459,7 @@ func LookupUser(ctx context.Context, username string, user *AuthContext) error {
 			if err = rows.Err(); err != nil {
 				return err
 			}
-			panic(errors.New("Multiple users of the same username; invariant broken"))
+			panic(fmt.Errorf("Multiple users of the same username; invariant broken"))
 		}
 		return nil
 	})
@@ -643,7 +642,7 @@ func Middleware(conf ini.File, apiconf string) func(http.Handler) http.Handler {
 func ForContext(ctx context.Context) *AuthContext {
 	raw, ok := ctx.Value(userCtxKey).(*AuthContext)
 	if !ok {
-		panic(errors.New("Invalid authentication context"))
+		panic(fmt.Errorf("Invalid authentication context"))
 	}
 	return raw
 }
diff --git a/errors/errors.go b/errors/errors.go
index f32b55a7d39b4b545e8738e0a539792916380fd8..7f8eef32dd3c1ac62636370f281edd9c969c8c07 100644
--- a/errors/errors.go
+++ b/errors/errors.go
@@ -35,6 +35,7 @@ var (
 	AccessDenied ErrorCode = "ERR_ACCESS_DENIED"
 	NotFound     ErrorCode = "ERR_NOT_FOUND"
 	Unsupported  ErrorCode = "ERR_UNSUPPORTED"
+	Unauthorized ErrorCode = "ERR_UNAUTHORIZED"
 )
 
 // Error codes as Go errors
@@ -42,4 +43,5 @@ var (
 	ErrAccessDenied = New(AccessDenied, "Access denied")
 	ErrNotFound     = New(NotFound, "Resource not found")
 	ErrUnsupported  = New(Unsupported, "Not supported")
+	ErrUnauthorized = New(Unauthorized, "Unauthorized")
 )