return proper status code 401/403 for various token auth situations

[lstruman]

No description provided.

[Copilot]

🟢 Approval recommended

The changes are cohesive, improve security correctness and status-code semantics, and are backed by comprehensive, targeted tests across token, JWKS, and HTTP middleware paths.

Pull request overview

This PR corrects authentication vs authorization handling across the server by returning 401 Unauthorized for token/authentication failures and 403 Forbidden for authenticated-but-not-authorized cases (e.g., insufficient capabilities / low trust), while also hardening token parsing to avoid trusting unverified claims and preventing panics on malformed claims.

Changes:

• Adjust middleware and response handling to consistently classify failures as 401 vs 403 (and 400 for missing/invalid route vars like mac).
• Ensure JWT capability checks occur only after cryptographic verification; add safer claim type handling.
• Add extensive unit tests covering malformed/expired/invalid-signature tokens, capability enforcement, JWKS verification, and HTTP status classification.

File summaries

File	Description
security/token.go	Defers capability checks until after signature/claim validation; avoids panic on non-string partner-id.
security/token_test.go	Adds regression tests for invalid signature/expired token classification and malformed partner-id handling.
security/jwks_manager.go	Hardens capabilities parsing; adds NewJwksManagerFromJWKS for testability.
security/jwks_manager_test.go	Adds end-to-end JWKS-backed tests (valid, missing capability, malformed capability, invalid signature, expired).
http/webconfig_server.go	Returns 400 for missing/invalid mac; returns 401 for authentication failures and 403 for capability/low-trust failures.
http/webconfig_server_test.go	Adds broad middleware status-code coverage for both TokenManager and JWKS-enabled paths.
http/response.go	Ensures 401 responses follow the same “header-only” behavior as 403/304/204.
http/multipart_test.go	Updates expected status for unauthenticated access and adds wrong-mac token 401 regression.
http/http_client.go	Treats 401 like other expected client error statuses in response handling.
common/error.go	Introduces a shared ErrNoCapabilities sentinel for consistent errors.Is checks.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.