GKaszewski/movies-diary
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: invalid-credentials code, no refresh on wrong pw

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-10-26 02:58:55 +01:00
parent 4714216093
commit bc3c9e3d23
10 changed files with 44 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/adr/0014-http-adapter-and-one-refusal-shape.md
View File

@@ -16,7 +16,8 @@ rate limiter's own 429 text. The refusals were documented without a body schema.
**One body.** `api_types::ErrorResponse { error, code }`. `error` keeps its name and meaning (the
SPA and existing clients read it); `code` is an additive, stable machine-readable field:
`NOT_FOUND`, `INVALID_INPUT`, `UNAUTHORIZED`, `FORBIDDEN`, `CONFLICT`, `RATE_LIMITED`, `INTERNAL`.
`NOT_FOUND`, `INVALID_INPUT`, `UNAUTHORIZED`, `INVALID_CREDENTIALS` (wrong password on a re-auth
check; unlike `UNAUTHORIZED` it must not trigger a token refresh), `FORBIDDEN`, `CONFLICT`, `RATE_LIMITED`, `INTERNAL`.
**One constructor.** `errors::refuse(status, code, message) -> Response` is the only place a JSON
error body is built. `ApiError` maps every `DomainError` variant to it with the status mapping that