From e2d65c627f2591a72c60c3ae20e5ab6572338d89 Mon Sep 17 00:00:00 2001 From: Evan Jarrett Date: Sat, 25 Oct 2025 00:37:46 -0500 Subject: [PATCH] we only use service tokens now --- pkg/hold/pds/xrpc.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkg/hold/pds/xrpc.go b/pkg/hold/pds/xrpc.go index 40d79aa..42d2a67 100644 --- a/pkg/hold/pds/xrpc.go +++ b/pkg/hold/pds/xrpc.go @@ -120,10 +120,11 @@ func (h *XRPCHandler) requireOwnerOrCrewAdmin(next http.Handler) http.Handler { // Stores validated user in request context func (h *XRPCHandler) requireAuth(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - user, err := ValidateDPoPRequest(r, h.httpClient) + // Service token authentication + user, err := ValidateServiceToken(r, h.pds.did, h.httpClient) if err != nil { - http.Error(w, fmt.Sprintf("authentication failed: %v", err), http.StatusUnauthorized) - return + http.Error(w, fmt.Sprintf("unauthorized: %v", err), http.StatusForbidden) + return } // Store user in context for handlers to access ctx := context.WithValue(r.Context(), contextKeyUser, user)