GET /api/v1/user without a token answers 403 instead of 401 issue #303 closed: completed andymccall opened this 11 days ago · 0 comments

Found building the Android app: Caller::require (crates/hub/src/api/mod.rs) checks the scope before whether there is an account, so a request with no token gets 403 "lacks the user:read scope". It should be 401 (sign in), so clients know to sign in again rather than that a token lacks a scope.