Loakesh Indiran afc0d18d9b fix: return 401 Unauthorized instead of 403 Forbidden for authentication failures (#9564) ...

## Problem

APIs were returning **403 Forbidden** when tokens were invalid or
expired, which is incorrect. According to HTTP specifications:
- **401 Unauthorized**: Authentication failure (invalid/expired token,
user not found)
- **403 Forbidden**: Authorization failure (authenticated but lacks
permissions)

## Changes

- [x] Previously, short URL paths would redirect to `/web/` on auth
failure. Now they consistently return 401 like all other endpoints.

### token.rs
- Changed `ErrorForbidden` to `ErrorUnauthorized` when token validation
fails (`is_valid == false`)
- Changed `ErrorForbidden` to `ErrorUnauthorized` when user does not
exist in the system
- Changed `ErrorForbidden` to `ErrorUnauthorized` for non-enterprise
builds (unsupported auth method)
- Kept `ErrorForbidden` only for `check_permissions()` failures (true
authorization issues)

2025-12-10 18:28:42 +05:30

..

grpc

feat: add metrics workgroup (#9400)

2025-12-04 21:43:31 +05:30

http

fix: return 401 Unauthorized instead of 403 Forbidden for authentication failures (#9564)

2025-12-10 18:28:42 +05:30

mod.rs

feat: remove syslog (#8227)

2025-09-01 14:47:47 +08:00