From dcbe05165401ccf3d150d9b68bd1e54aee9d6f4b Mon Sep 17 00:00:00 2001
From: Sandro Santilli <strk@keybit.net>
Date: Wed, 5 Sep 2012 20:16:55 +0200
Subject: [PATCH] Return 401 status for unauthorized requests (see #48)

---
 lib/cartodb/server_options.js |  2 +-
 test/acceptance/server.js     | 16 ++++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/cartodb/server_options.js b/lib/cartodb/server_options.js
index b99f65a5..81433005 100644
--- a/lib/cartodb/server_options.js
+++ b/lib/cartodb/server_options.js
@@ -48,7 +48,7 @@ module.exports = function(){
             },
             function gatekeep(err, data){
                 if(err) throw err;
-                if(data === "0") throw new Error("Sorry, you are unauthorized");
+                if(data === "0") throw new Error("Sorry, you are unauthorized (permission denied)");
                 return data;
             },
             function getDatabase(err, data){
diff --git a/test/acceptance/server.js b/test/acceptance/server.js
index 6afcdcd4..fd294a3e 100644
--- a/test/acceptance/server.js
+++ b/test/acceptance/server.js
@@ -53,7 +53,7 @@ suite('server', function() {
             method: 'GET'
         },{
         }, function(res) {
-          // TODO: should be "403 - forbidden" instead
+          // FIXME: should be 401 Unauthorized
           assert.equal(res.statusCode, 500, res.body);
           done();
         });
@@ -97,7 +97,7 @@ suite('server', function() {
             headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' },
             data: querystring.stringify({style: '#my_table3{backgxxxxxround-color:#fff;}'})
         },{
-            status: 500,
+            status: 500, // FIXME: should be 400 !
             body: JSON.stringify(['style.mss:1:11 Unrecognized rule: backgxxxxxround-color'])
         }, function() { done(); });
     });
@@ -109,7 +109,7 @@ suite('server', function() {
             headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' },
             data: querystring.stringify({style: '#my_table4{backgxxxxxround-color:#fff;foo:bar}'})
         },{
-            status: 500,
+            status: 500, // FIXME: should be 400 !
             body: JSON.stringify([ 'style.mss:1:11 Unrecognized rule: backgxxxxxround-color', 'style.mss:1:38 Unrecognized rule: foo' ])
         }, function() { done(); });
     });
@@ -134,7 +134,7 @@ suite('server', function() {
             headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' },
             data: querystring.stringify({style: 'Map {background-color:#aaa;}'})
         },{}, function(res) {
-          // fixme: we should really return a 403 here
+          // FIXME: should be 401 Unauthorized
           assert.equal(res.statusCode, 500, res.body);
           assert.ok(res.body.indexOf('map state cannot be changed by unauthenticated request') != -1, res.body);
 
@@ -189,7 +189,7 @@ suite('server', function() {
             method: 'DELETE',
             headers: {host: 'vizzuality'},
         },{}, function(res) { 
-          // fixme: we should really return a 403 here
+          // FIXME: should be 401 Unauthorized
           assert.equal(res.statusCode, 500, res.body);
           assert.ok(res.body.indexOf('map state cannot be changed by unauthenticated request') != -1, res.body);
           // check that the style wasn't really deleted !
@@ -286,7 +286,7 @@ suite('server', function() {
             url: '/tiles/test_table_private_1/infowindow',
             method: 'GET'
         },{}, function(res) {
-          // NOTE: it would be better to get a '403 - forbidden' here...
+          // FIXME: should be 401 Unauthorized
           assert.equal(res.statusCode, 500, res.body);
           done();
         });
@@ -351,8 +351,8 @@ suite('server', function() {
             url: '/tiles/test_table_private_1/6/31/24.grid.json',
             method: 'GET'
         },{}, function(res) {
-          // FIXME: should be 401 Unauthorized
-          assert.equal(res.statusCode, 400, res.statusCode + ': ' + res.body);
+          // 401 Unauthorized
+          assert.equal(res.statusCode, 401, res.statusCode + ': ' + res.body);
           done();
         });
     });