1 files changed, 8 insertions(+), 3 deletions(-)

M authn/bearer.go

@@ 172,8 172,13 @@ func instanceTokenLabel(tok *bearer.Token) string {
 //     they need is a wider grant, not another login. Both are asked before the
 //     bearer table, because ErrMissingGrant is raised beside a token that
 //     verified and must not be read as one that did not.
-//   - ErrNoToken is 401: nothing was presented on a surface that requires a
-//     credential.
+//   - Whatever else IsAuthFailure calls permanent is 401 — today that is
+//     ErrNoToken, nothing having been presented on a surface that requires a
+//     credential. The predicate is asked rather than the sentinel listed a second
+//     time, so that a sentinel added to one of them cannot be missing from the
+//     other: this package's two answers to "is the credential the problem?" have
+//     to agree, and the cheapest way to guarantee that is for one to be built
+//     from the other.
 //   - ErrNoAgentPlane, and anything else at all, is 503. An instance with no
 //     [tokens.sr.ht] origin cannot check any credential, and telling the holder
 //     of a good token that it is bad would send them to re-provision it; an


@@ 190,7 195,7 @@ func StatusFor(err error) int {
 		return http.StatusForbidden
 	case isBearerRefusal(err):
 		return bearer.StatusFor(err)
-	case errors.Is(err, ErrNoToken):
+	case IsAuthFailure(err):
 		return http.StatusUnauthorized
 	default:
 		return http.StatusServiceUnavailable