fix: treat 401/403 from exchange as invalid-ticket (single-use UX)

2026-09-04 15:01:01 +00:00
parent ed0c606aae
commit f66a4e2d53
1 changed files with 3 additions and 2 deletions
@@ -236,8 +236,9 @@ async function redeemTicket(ticket) {
  } finally {
    clearTimeout(timer);
  }
-  if (resp.status === 404) {
-    // Ticket unknown or already redeemed (single-use)
+  if (resp.status === 404 || resp.status === 401 || resp.status === 403) {
+    // Ticket unknown / already redeemed (single-use) or bad server-to-server
+    // credentials — indistinguishable from the client's perspective.
    throw Object.assign(new Error('Invalid or expired ticket'), { status: 401 });
  }
  if (!resp.ok) {