Return proper 401/403 when access denied

Fixes #584

src/PostgREST/Middleware.hs

@@ -7,7 +7,6 @@ import           Data.Aeson                    (Value (..))
 import qualified Data.HashMap.Strict           as M
 import           Data.String.Conversions       (cs)
 import           Data.Text
-import           Data.Time.Clock               (NominalDiffTime)
 import qualified Hasql.Transaction             as H
 
 import           Network.HTTP.Types.Header     (hAccept)
@@ -19,28 +18,26 @@ import           Network.Wai.Middleware.Gzip   (def, gzip)
 import           Network.Wai.Middleware.Static (only, staticPolicy)
 
 import           PostgREST.ApiRequest          (ApiRequest(..), pickContentType)
-import           PostgREST.Auth                (jwtClaims, claimsToSQL)
+import           PostgREST.Auth                (claimsToSQL)
 import           PostgREST.Config              (AppConfig (..), corsPolicy)
 import           PostgREST.Error               (errResponse)
 
 import           Prelude                       hiding (concat, null)
 
-runWithClaims :: AppConfig -> NominalDiffTime ->
+runWithClaims :: AppConfig -> Either Text (M.HashMap Text Value) ->
                  (ApiRequest -> H.Transaction Response) ->
                  ApiRequest -> H.Transaction Response
-runWithClaims conf time app req = do
-    let eClaims = jwtClaims jwtSecret (iJWT req) time
-    case eClaims of
-      Left e -> clientErr e
-      Right claims ->
-        if M.null claims && not (null $ iJWT req)
-          then clientErr "Invalid JWT"
-          else do
-            -- role claim defaults to anon if not specified in jwt
-            H.sql . mconcat . claimsToSQL $ M.union claims (M.singleton "role" anon)
-            app req
+runWithClaims conf eClaims app req =
+  case eClaims of
+    Left e -> clientErr e
+    Right claims ->
+      if M.null claims && not (null $ iJWT req)
+        then clientErr "Invalid JWT"
+        else do
+          -- role claim defaults to anon if not specified in jwt
+          H.sql . mconcat . claimsToSQL $ M.union claims (M.singleton "role" anon)
+          app req
   where
-    jwtSecret = configJwtSecret conf
     anon = String . cs $ configAnonRole conf
     clientErr = return . errResponse status400