Issue http 401 for expired jwt

Fixes #512

src/PostgREST/Middleware.hs

@@ -7,33 +7,32 @@ import           Data.Aeson                    (Value (..))
 import qualified Data.HashMap.Strict           as M
 import qualified Hasql.Transaction             as H
 
-import           Network.HTTP.Types.Status     (status400)
+import           Network.HTTP.Types.Status     (badRequest400, unauthorized401)
 import           Network.Wai                   (Application, Response)
 import           Network.Wai.Middleware.Cors   (cors)
 import           Network.Wai.Middleware.Gzip   (def, gzip)
 import           Network.Wai.Middleware.Static (only, staticPolicy)
 
 import           PostgREST.ApiRequest          (ApiRequest(..))
-import           PostgREST.Auth                (claimsToSQL)
+import           PostgREST.Auth                (claimsToSQL, JWTAttempt(..))
 import           PostgREST.Config              (AppConfig (..), corsPolicy)
 import           PostgREST.Error               (errResponse)
-import           Data.Text
 
 import           Protolude                     hiding (concat, null)
 
-runWithClaims :: AppConfig -> Either Text (M.HashMap Text Value) ->
+runWithClaims :: AppConfig -> JWTAttempt ->
                  (ApiRequest -> H.Transaction Response) ->
                  ApiRequest -> H.Transaction Response
 runWithClaims conf eClaims app req =
   case eClaims of
-    Left e -> clientErr e
-    Right claims -> do
-          -- role claim defaults to anon if not specified in jwt
-          H.sql . mconcat . claimsToSQL $ M.union claims (M.singleton "role" anon)
-          app req
+    JWTExpired -> return $ errResponse unauthorized401 "JWT expired"
+    JWTInvalid -> return $ errResponse badRequest400 "JWT invalid"
+    JWTClaims claims -> do
+      -- role claim defaults to anon if not specified in jwt
+      H.sql . mconcat . claimsToSQL $ M.union claims (M.singleton "role" anon)
+      app req
   where
     anon = String . toS $ configAnonRole conf
-    clientErr = return . errResponse status400
 
 defaultMiddle :: Application -> Application
 defaultMiddle =