From 5318d23f2fb959eaec4198a5d0a52e8d05dad35f Mon Sep 17 00:00:00 2001
From: Charles Langlois <charles.langlois@wazo.io>
Date: Tue, 5 May 2026 17:08:36 -0400
Subject: [PATCH] http_exceptions: insufficient permissions use 403 status code

---
 xivo/http_exceptions.py          |  8 +++----
 xivo/tests/test_auth_verifier.py | 36 +++++++++++++++++++++++++++++++-
 2 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/xivo/http_exceptions.py b/xivo/http_exceptions.py
index 470bedc..8022cdf 100644
--- a/xivo/http_exceptions.py
+++ b/xivo/http_exceptions.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2024 The Wazo Authors  (see the AUTHORS file)
+# Copyright 2015-2026 The Wazo Authors  (see the AUTHORS file)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from __future__ import annotations
@@ -49,9 +49,9 @@ def __init__(
             'tenant_uuid': tenant_uuid,
         }
         super().__init__(
-            status_code=401,
-            message='Unauthorized',
-            error_id='unauthorized',
+            status_code=403,
+            message='Forbidden',
+            error_id='forbidden',
             details=details,
         )
 
diff --git a/xivo/tests/test_auth_verifier.py b/xivo/tests/test_auth_verifier.py
index 7028392..8a188eb 100644
--- a/xivo/tests/test_auth_verifier.py
+++ b/xivo/tests/test_auth_verifier.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2025 The Wazo Authors  (see the AUTHORS file)
+# Copyright 2015-2026 The Wazo Authors  (see the AUTHORS file)
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import unittest
@@ -66,6 +66,40 @@ def test_validate_token_with_no_acl_permission_raises_exception(self):
                 tenant_uuid,
             )
 
+    def test_validate_token_with_no_acl_permission_raises_403(self):
+        mock_client = Mock()
+        mock_client.token.check.side_effect = MissingPermissionsTokenException
+        token_uuid = s.token
+        tenant_uuid = s.tenant
+        required_acl = s.acl
+
+        with pytest.raises(MissingPermissionsTokenAPIException) as exc_info:
+            self.helpers.validate_token(
+                mock_client,
+                token_uuid,
+                required_acl,
+                tenant_uuid,
+            )
+
+        assert exc_info.value.status_code == 403
+
+    def test_validate_invalid_token_raises_401(self):
+        mock_client = Mock()
+        mock_client.token.check.side_effect = InvalidTokenException
+        token_uuid = s.token
+        tenant_uuid = s.tenant
+        required_acl = s.acl
+
+        with pytest.raises(InvalidTokenAPIException) as exc_info:
+            self.helpers.validate_token(
+                mock_client,
+                token_uuid,
+                required_acl,
+                tenant_uuid,
+            )
+
+        assert exc_info.value.status_code == 401
+
     def test_validate_token_raise_unreachable(self):
         mock_client = Mock()
         mock_client.token.check.side_effect = requests.RequestException