Return 401 instead and fix some tests

Author: amiedes

lib/api/middlewares/authorization.js

@@ -8,10 +8,14 @@ module.exports = function authorization (metadataBackend, forceToBeMaster = fals
         const { user } = res.locals;
         const credentials = getCredentialsFromRequest(req);
 
-        if (!userMatches(credentials, user) || !credentials.apiKeyToken) {
+        if (!userMatches(credentials, user)) {
             req.profiler.done('authorization');
 
             return next(new Error('permission denied'));
+        } else if (!credentials.apiKeyToken) {
+            req.profiler.done('authorization');
+
+            return next(new Error('unauthorized'));
         }
 
         res.locals.api_key = credentials.apiKeyToken;

lib/services/error-handler.js

@@ -32,6 +32,8 @@ class ErrorHandler extends Error {
     getHttpStatus (httpStatus = 400) {
         if (this.message.includes('permission denied')) {
             return 403;
+        } else if (this.message.includes('unauthorized')) {
+            return 401;
         }
 
         return httpStatus;

test/acceptance/app-auth-test.js

@@ -8,9 +8,9 @@ var assert = require('../support/assert');
 describe('app.auth', function () {
     var scenarios = [
         {
-            desc: 'no api key should fallback to default api key',
+            desc: 'no api key should return 401',
             url: '/api/v1/sql?q=SELECT%20*%20FROM%20untitle_table_4',
-            statusCode: 200
+            statusCode: 401
         },
         {
             desc: 'invalid api key should return 401',
@@ -35,12 +35,12 @@ describe('app.auth', function () {
         {
             desc: 'no api key should NOT allow insert in protected tables',
             url: "/api/v1/sql?q=INSERT%20INTO%20private_table%20(name)%20VALUES%20('RAMBO')",
-            statusCode: 403
+            statusCode: 401
         },
         {
             desc: 'no api key should NOT allow insert in public tables',
             url: "/api/v1/sql?q=INSERT%20INTO%20untitle_table_4%20(name)%20VALUES%20('RAMBO')",
-            statusCode: 403
+            statusCode: 401
         }
     ];