Repository navigation
fix(api): expired-token status codes differ across approve, cancel, revoke and RI-exchange token actions #587
Description
Summary
Found in the review of PR #584. After #584, approve and cancel answer 410 for an expired approval token, but validateRevokeToken (internal/api/handler_purchases.go ~1558-1565) still answers 403 for an invalid token and 409 for an expired one, and the RI-exchange token path (internal/api/handler_ri_exchange.go ~2447) answers 403 for an invalid token with its own expiry handling. The three token families are inconsistent for the same condition.
Acceptance
Decide one mapping (invalid, expired, wrong status) for all emailed-token actions, apply it to revoke and the RI-exchange paths with tests, and update openapi.yaml. Needs an owner decision on 409 vs 410 for expired tokens.
Activity
IAmJSD commentedon Oct 20, 2026
Claiming: working on this
IAmJSD commentedon Oct 26, 2026
Decision (IAmJSD, acting owner, 2026-10-26): the emailed-token actions (approve, cancel, revoke, RI exchange approve/reject) all use one mapping:
This keeps the codes approve and cancel already return (the frontend already shows 410 as "link expired"). It is implemented by #1172 (revoke and RI exchange use 403/410/409) and #1175 (a missing exchange answers like a wrong token, for #601). Neither is merged yet; they go through the normal review and merge path. The remaining session-path leak cristim flagged on #1175 is tracked in #1428.
Posted by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).
fix(api): answer expired and lost-race token actions alike on revoke …
fix(api): answer a missing RI exchange like a wrong token on approve …