Throw "401 Unauthenticated" when authentication is provided but invalid

[nickvergessen]

E.g. with an AppToken that has been revoked

[LukasReschke]

Seems reasonable to me. Let's see what tests etc say :)

For master only - right?

[nickvergessen]

Well the older the better so talk clients get a proper 401 instead of a 404 room not found when the token was revoked, but yeah master only for now

[korelstar]

Hey @nickvergessen @LukasReschke @ChristophWurst , this is a critical change: due to this PR, my API tests for the notes app are failing!

The notes app provides an API for third-party apps. This is implemented using the OCP\AppFramework\ApiController. I have a test for this API which also tests an unauthorized request to the API.

Before this PR, the API has returned HTTP status code 401. After this PR, the API returns HTTP status code 403. This applies to both scenarios: a) a request without any authentication credentials and b) a request with invalid authentication credentials.

Hence, this PR is a breaking change which definitely should not be backported! Furthermore, I'm unsure if this change was intended. The PR title is about throwing HTTP status code 401. But in fact, HTTP status code 403 is thrown now.

Please give an advise if this change will be kept up, since I would have to inform the developers of third-party apps then. This should be also added to the pinned issue regarding critical changes.

[nickvergessen]

Just for the record, discussing this currently in the community chat.

Talk also had failing integration tests, because it was using a user which didn't exist: nextcloud/spreed#5542

[korelstar]

@nickvergessen

As requested in the chat, here is my test:

https://github.com/nextcloud/notes/blob/master/tests/api/CommonAPITest.php#L257-L261

Example run (failed):
https://github.com/nextcloud/notes/runs/2472476523
from GitHub Workflow:
https://github.com/nextcloud/notes/blob/master/.github/workflows/test.yml

Here is the ApiController which is tested: https://github.com/nextcloud/notes/blob/master/lib/Controller/NotesApiController.php

Thanks for having a look!

[nickvergessen]

Follow up in #26846