Return 403 instead of 401 when required permissions are missing (#9)

Author: mduesterhoeft

router/src/main/kotlin/io/moia/router/RequestHandler.kt

@@ -33,7 +33,7 @@ abstract class RequestHandler : RequestHandler<APIGatewayProxyRequestEvent, APIG
                 val matchedAcceptType = routerFunction.requestPredicate.matchedAcceptType(input.acceptedMediaTypes())
                     ?: MediaType.parse(router.defaultContentType)
                 if (!permissionHandlerSupplier()(input).hasAnyRequiredPermission(routerFunction.requestPredicate.requiredPermissions))
-                    return createApiExceptionErrorResponse(matchedAcceptType, input, ApiException("unauthorized", "UNAUTHORIZED", 401))
+                    return createApiExceptionErrorResponse(matchedAcceptType, input, ApiException("missing permissions", "MISSING_PERMISSIONS", 403))
 
                 val handler: HandlerFunction<Any, Any> = routerFunction.handler
                 return try {

router/src/test/kotlin/io/moia/router/RequestHandlerTest.kt

@@ -244,7 +244,7 @@ class RequestHandlerTest {
                 )), mockk()
         )
 
-        assert(response.statusCode).isEqualTo(401)
+        assert(response.statusCode).isEqualTo(403)
     }
 
     @Test