Disambiguate 401 and 403 when accessing /projects

[fspeirs]

Previously, Editor-API would return a 403 error for any project access that failed, including accesses that should have received a 401 Unauthorized error.

This change checks the state of current_user to decide whether to return 401 or 403. This will then allow client applications like Experience CS to properly route the user to either log in and retry or present an error page with explanations as to why the 403 occurred.

Status

• Related to RaspberryPiFoundation/experience-cs#1890

Points for consideration:

• Security
  • It may appear as if this change now leaks the existence of a given project identifier to an unauthenticated user but they were being leaked anyway. Some APIs return 404 to unauthenticated users accessing specific record endpoints in order to prevent identifier enumeration, but editor-api never did this anyway.

What's changed?

• Modification to api_controller.rb#denied to:
  • render status: :forbidden when the user is logged in but denied access
  • rebder status: :unauthorized when the user is NOT logged in and denied access.

Previously, both conditions would render :forbidden.

Steps to perform after deploying to production

Nothing required.

No changes are required in editor-ui either as 401 and 403 are already handled identically in loadProjectReducers.js in that codebase.

[github-actions]

Test coverage

90.01% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/22895692571

[Copilot]

Pull request overview

Updates the API’s global CanCan::AccessDenied handling to return 401 Unauthorized for unauthenticated requests and 403 Forbidden for authenticated-but-denied requests, enabling clients to distinguish “needs login” vs “insufficient permission” flows (notably for /projects access).

Changes:

• Adjust ApiController#denied to conditionally render 401 vs 403 based on current_user presence.
• Update request specs to cover both authenticated and unauthenticated CanCan::AccessDenied scenarios and assert the new response bodies.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
app/controllers/api_controller.rb	Changes CanCan::AccessDenied rescue behavior to return 401 when unauthenticated and 403 when authenticated.
spec/requests/api_controller_spec.rb	Updates/extends request specs to validate the new 401/403 behavior and corresponding JSON error messages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.