Hermes/refboard-ayon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: treat 401/403 from exchange as invalid-ticket (single-use UX)

Browse Source
This commit is contained in:
Hermes
2026-09-04 15:01:01 +00:00
parent ed0c606aae
commit f66a4e2d53
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/routes/auth.js
+3 -2
View File
@@ -236,8 +236,9 @@ async function redeemTicket(ticket) {
} finally { } finally {
clearTimeout(timer); clearTimeout(timer);
} }
if (resp.status === 404) { if (resp.status === 404 || resp.status === 401 || resp.status === 403) {
// Ticket unknown or already redeemed (single-use) // Ticket unknown / already redeemed (single-use) or bad server-to-server
// credentials — indistinguishable from the client's perspective.
throw Object.assign(new Error('Invalid or expired ticket'), { status: 401 }); throw Object.assign(new Error('Invalid or expired ticket'), { status: 401 });
} }
if (!resp.ok) { if (!resp.ok) {