backend-app-api: treat rejected none credentials as 401

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts

@@ -124,6 +124,9 @@ class DefaultHttpAuthService implements HttpAuthService {
       allowedPrincipalTypes &&
       !allowedPrincipalTypes.includes(credentials.principal.type as TAllowed)
     ) {
+      if (credentials.authMethod === 'none') {
+        throw new AuthenticationError();
+      }
       throw new NotAllowedError(
         `This endpoint does not allow '${credentials.principal.type}' credentials`,
       );

packages/backend-test-utils/src/next/services/MockHttpAuthService.test.ts

@@ -17,6 +17,7 @@
 import { Request } from 'express';
 import { MockHttpAuthService } from './MockHttpAuthService';
 import { mockCredentials } from './mockCredentials';
+import { AuthenticationError } from '@backstage/errors';
 
 describe('MockHttpAuthService', () => {
   const httpAuth = new MockHttpAuthService('test', mockCredentials.none());
@@ -36,7 +37,7 @@ describe('MockHttpAuthService', () => {
 
     await expect(
       httpAuth.credentials(makeAuthReq(), { allow: ['user'] }),
-    ).rejects.toThrow("This endpoint does not allow 'none' credentials");
+    ).rejects.toThrow(AuthenticationError);
 
     await expect(httpAuth.credentials(makeAuthReq())).resolves.toEqual(
       mockCredentials.none(),

packages/backend-test-utils/src/next/services/MockHttpAuthService.ts

@@ -22,7 +22,11 @@ import {
 } from '@backstage/backend-plugin-api';
 import { Request, Response } from 'express';
 import { MockAuthService } from './MockAuthService';
-import { NotAllowedError, NotImplementedError } from '@backstage/errors';
+import {
+  AuthenticationError,
+  NotAllowedError,
+  NotImplementedError,
+} from '@backstage/errors';
 import { mockCredentials } from './mockCredentials';
 
 // TODO: support mock cookie auth?
@@ -73,9 +77,7 @@ export class MockHttpAuthService implements HttpAuthService {
         return credentials as any;
       }
 
-      throw new NotAllowedError(
-        `This endpoint does not allow 'none' credentials`,
-      );
+      throw new AuthenticationError();
     } else if (this.#auth.isPrincipal(credentials, 'user')) {
       if (allowedPrincipalTypes.includes('user' as TAllowed)) {
         return credentials as any;