From 28b89ea3aabd5165c0f99f30cba8dcaeeed9a636 Mon Sep 17 00:00:00 2001
From: zkldi <notzkldi@zkldi.com>
Date: Sat, 26 Jun 2021 00:10:44 +0100
Subject: [PATCH] fix some 401s to 403s

---
 server/src/server/middleware/auth.ts                        | 2 +-
 server/src/server/middleware/require-logged-in.ts           | 2 +-
 server/src/server/router/api/v1/users/_userID/middleware.ts | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/src/server/middleware/auth.ts b/server/src/server/middleware/auth.ts
index 8e857cd1b..e2fee4a9c 100644
--- a/server/src/server/middleware/auth.ts
+++ b/server/src/server/middleware/auth.ts
@@ -121,7 +121,7 @@ export const RequirePermissions =
 					req.url
 				}. ${missingPerms.join(", ")}`
 			);
-			return res.status(401).json({
+			return res.status(403).json({
 				success: false,
 				description: `You are missing the following permissions necessary for this request: ${missingPerms.join(
 					", "
diff --git a/server/src/server/middleware/require-logged-in.ts b/server/src/server/middleware/require-logged-in.ts
index d761682f1..698d97c3e 100644
--- a/server/src/server/middleware/require-logged-in.ts
+++ b/server/src/server/middleware/require-logged-in.ts
@@ -7,7 +7,7 @@ export const RequireLoggedInSession: RequestHandler = (req, res, next) => {
 	if (!req.session.tachi?.userID) {
 		logger.info(`Received unauthorised request from ${req.ip} from ${req.originalUrl}`);
 
-		return res.status(401).json({
+		return res.status(403).json({
 			success: false,
 			description: `You are not authorised to perform this action.`,
 		});
diff --git a/server/src/server/router/api/v1/users/_userID/middleware.ts b/server/src/server/router/api/v1/users/_userID/middleware.ts
index 7976de8b1..90290deb7 100644
--- a/server/src/server/router/api/v1/users/_userID/middleware.ts
+++ b/server/src/server/router/api/v1/users/_userID/middleware.ts
@@ -42,7 +42,7 @@ export const RequireAuthedAsUser: RequestHandler = (req, res, next) => {
 	const user = req[SYMBOL_TachiData]!.requestedUser!;
 
 	if (req[SYMBOL_TachiAPIAuth].userID !== user.id) {
-		return res.status(401).json({
+		return res.status(403).json({
 			success: false,
 			description: "You are not authorised as this user.",
 		});