bug: need to return 401 rather than 403 on OpenRosa submission endpoint.

getodk · Aug 12, 2020 · 7b13eb7 · 7b13eb7
1 parent 0d7e73f
commit 7b13eb7
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/lib/resources/submissions.js b/lib/resources/submissions.js
@@ -65,6 +65,8 @@ module.exports = (service, endpoint) => {
         // now we have the information we need to get the correct form; do so
         // and make sure we can actually submit to it.
         .then((partial) => getForm(auth, params, partial.xmlFormId, Form, partial.version)
+          // for openrosa endpoints, we must return 401 rather than 403.
+          .catch(Problem.translate(Problem.user.insufficientRights, Problem.user.authenticationFailed))
           .then((form) => Promise.all([
             Submission.getById(form.id, partial.instanceId, draft, QueryOptions.extended),
             form.def.getBinaryFields()

diff --git a/test/integration/api/submissions.js b/test/integration/api/submissions.js
@@ -47,7 +47,7 @@ describe('api: /submission', () => {
       service.post('/v1/projects/1/submission')
         .set('X-OpenRosa-Version', '1.0')
         .attach('xml_submission_file', Buffer.from(testData.instances.simple.one), { filename: 'data.xml' })
-        .expect(403)));
+        .expect(401)));
 
     it('should reject if the form is not taking submissions', testService((service) =>
       service.login('alice', (asAlice) =>