From ef01e8c96d714965b2e80ce1306786fbb017812f Mon Sep 17 00:00:00 2001
From: hardik4love-lang <hardik4love@gmail.com>
Date: Fri, 13 Nov 2026 10:51:39 +0530
Subject: [PATCH] fix(auth): return 401 for rejected Passport exchange codes
 (#1281)

---
 src/auth/passport.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/auth/passport.ts b/src/auth/passport.ts
index e7326cd7e..e4bfc3ac5 100644
--- a/src/auth/passport.ts
+++ b/src/auth/passport.ts
@@ -314,6 +314,9 @@ const callback = async (req: Request): Promise<Response> => {
       redirect: "error",
       signal: AbortSignal.timeout(10_000),
     });
+    if (response.status >= 400 && response.status < 500) {
+      throw new PassportError(401);
+    }
     const body = await boundedJson(response, 65_536);
     if (!isRecord(body) || typeof body.accessToken !== "string") throw new PassportError();
     const claims = await verifyToken(body.accessToken);