fix: invalid-credentials code, no refresh on wrong pw

crates/adapters/http-axum/src/errors.rs

@@ -8,6 +8,7 @@ use domain::errors::DomainError;
 pub const NOT_FOUND: &str = "NOT_FOUND";
 pub const INVALID_INPUT: &str = "INVALID_INPUT";
 pub const UNAUTHORIZED: &str = "UNAUTHORIZED";
+pub const INVALID_CREDENTIALS: &str = "INVALID_CREDENTIALS";
 pub const FORBIDDEN: &str = "FORBIDDEN";
 pub const CONFLICT: &str = "CONFLICT";
 pub const RATE_LIMITED: &str = "RATE_LIMITED";
@@ -31,7 +32,9 @@ pub fn domain_error_status(e: &DomainError) -> StatusCode {
             StatusCode::BAD_REQUEST
         }
         DomainError::NotFound(_) => StatusCode::NOT_FOUND,
-        DomainError::Unauthorized(_) => StatusCode::UNAUTHORIZED,
+        DomainError::Unauthorized(_) | DomainError::InvalidCredentials(_) => {
+            StatusCode::UNAUTHORIZED
+        }
         DomainError::Forbidden(_) => StatusCode::FORBIDDEN,
         DomainError::Conflict(_) => StatusCode::CONFLICT,
         DomainError::InfrastructureError(_) => StatusCode::INTERNAL_SERVER_ERROR,
@@ -65,6 +68,9 @@ impl IntoResponse for ApiError {
             }
             DomainError::NotFound(_) => refuse(status, NOT_FOUND, self.0.to_string()),
             DomainError::Unauthorized(_) => refuse(status, UNAUTHORIZED, self.0.to_string()),
+            DomainError::InvalidCredentials(_) => {
+                refuse(status, INVALID_CREDENTIALS, self.0.to_string())
+            }
             DomainError::Forbidden(_) => refuse(status, FORBIDDEN, self.0.to_string()),
             DomainError::Conflict(_) => refuse(status, CONFLICT, self.0.to_string()),
             DomainError::InfrastructureError(_) => {

crates/application/src/users/request_account_deletion.rs

@@ -30,7 +30,7 @@ pub async fn execute(
         .verify(password, actor_user.password_hash())
         .await?
     {
-        return Err(DomainError::Unauthorized("incorrect password".into()));
+        return Err(DomainError::InvalidCredentials("incorrect password".into()));
     }
 
     let target_user = if is_self {

crates/application/tests/users/request_account_deletion_test.rs

@@ -138,7 +138,10 @@ async fn a_wrong_password_is_unauthorized_and_changes_nothing() {
         .await
         .unwrap_err();
 
-    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+    assert!(
+        matches!(err, DomainError::InvalidCredentials(_)),
+        "got {err:?}"
+    );
     assert!(f.is_live(&alice).await);
     assert!(f.store.recorded_events().is_empty());
 }
@@ -166,7 +169,10 @@ async fn an_admin_deletes_another_user_with_their_own_password() {
     let err = request_account_deletion::execute(&f.deps, admin.clone(), bob.clone(), "bobs-pw")
         .await
         .unwrap_err();
-    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+    assert!(
+        matches!(err, DomainError::InvalidCredentials(_)),
+        "got {err:?}"
+    );
     assert!(f.is_live(&bob).await);
 
     request_account_deletion::execute(&f.deps, admin.clone(), bob.clone(), PASSWORD)

crates/bootstrap/tests/account_deletion_test.rs

@@ -62,6 +62,7 @@ async fn self_delete_with_a_wrong_password_is_refused_and_keeps_the_account() {
     )
     .await;
     assert_eq!(status, 401, "{body}");
+    assert!(body.contains("\"INVALID_CREDENTIALS\""), "{body}");
     let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
     assert_eq!(status, 200);
 }
@@ -109,8 +110,9 @@ async fn an_admin_deletes_another_account() {
     promote(&pool, &alice.user_id).await;
     let uri = format!("/api/v1/users/{}", bob.user_id);
 
-    let (status, _, _) = send(&router, delete_json(&uri, &alice.token, "nope")).await;
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, "nope")).await;
     assert_eq!(status, 401, "wrong admin password");
+    assert!(body.contains("\"INVALID_CREDENTIALS\""), "{body}");
 
     let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
     assert_eq!(status, 204, "{body}");

crates/domain/src/errors/mod.rs

@@ -17,6 +17,9 @@ pub enum DomainError {
     #[error("Unauthorized: {0}")]
     Unauthorized(String),
 
+    #[error("Unauthorized: {0}")]
+    InvalidCredentials(String),
+
     #[error("Forbidden: {0}")]
     Forbidden(String),