Fix response_api_error() silently forcing 400 on every error

response_api_error() ignored its second positional status_code
argument and always returned HTTP 400, so callers passing 401/403
were lying to clients about the actual error. Add a proper
status_code keyword param and update call sites to use it.

Author: Che4ter

source/app/blueprints/rest/api_auth.py

@@ -72,7 +72,7 @@ def wrapper(*args, **kwargs):
             user = _jwt_user()
 
             if user == "invalid":
-                return response_api_error("Invalid token", 401)
+                return response_api_error("Invalid token", status_code=401)
 
             if user is None:
                 user = _legacy_token_user()
@@ -81,14 +81,14 @@ def wrapper(*args, **kwargs):
                 user = _session_user()
 
             if user is None:
-                return response_api_error("Unauthorized", 401)
+                return response_api_error("Unauthorized", status_code=401)
 
             if (
                 require_mfa
                 and app.config.get("MFA_ENABLED")
                 and not user.mfa_setup_complete
             ):
-                return response_api_error("MFA required", 403)
+                return response_api_error("MFA required", status_code=403)
 
             g.api_user = user
             return fn(*args, **kwargs)

source/app/blueprints/rest/endpoints.py

@@ -67,13 +67,13 @@ def response_api_created(data):
     return response(201, data=data)
 
 
-def response_api_error(message, data=None):
+def response_api_error(message, data=None, status_code=400):
     content = {
         'message': message
     }
     if data:
         content['data'] = data
-    return response(400, data=content)
+    return response(status_code, data=content)
 
 
 def response_api_not_found():

source/app/blueprints/rest/v2/auth.py

@@ -181,21 +181,21 @@ def oidc_exchange():
         session-based OIDC login has today.
     """
     if not is_authentication_oidc():
-        return response_api_error('OIDC authentication is not enabled', 400)
+        return response_api_error('OIDC authentication is not enabled', status_code=400)
 
     if not iris_current_user.is_authenticated:
-        return response_api_error('Unauthorized', 401)
+        return response_api_error('Unauthorized', status_code=401)
 
     if not session.pop('oidc_authenticated', False):
         # The user has a valid session but it wasn't created via the OIDC
         # callback (or the marker has already been consumed by a prior
         # exchange). Do NOT mint tokens.
-        return response_api_error('No pending OIDC exchange for this session', 403)
+        return response_api_error('No pending OIDC exchange for this session', status_code=403)
 
     user = users_get_active(iris_current_user.id)
     if user is None:
         session.clear()
-        return response_api_error('User not active', 403)
+        return response_api_error('User not active', status_code=403)
 
     user_data = UserSchema(
         exclude=['user_password', 'mfa_secrets', 'webauthn_credentials']