From d4fdf87daa4bb860d15eef439aa2d1a8ac5dc229 Mon Sep 17 00:00:00 2001
From: Ginger <ginger@gingershaped.computer>
Date: Tue, 9 Jun 2026 14:06:24 -0400
Subject: [PATCH] fix: Update error message wording

---
 src/api/router/auth.rs | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/src/api/router/auth.rs b/src/api/router/auth.rs
index 8ce52cef6..bc2cd38b6 100644
--- a/src/api/router/auth.rs
+++ b/src/api/router/auth.rs
@@ -101,7 +101,7 @@ fn authenticate<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]>
 		async move {
 			let output = Self::extract_authentication(incoming_request).map_err(|err| {
 				err!(Request(Unauthorized(warn!(
-					"Failed to extract authorization: {}",
+					"Failed to extract request authentication: {}",
 					err.into()
 				))))
 			})?;
@@ -131,8 +131,8 @@ async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]>
 			.server_keys
 			.get_verify_key(&output.origin, &output.key)
 			.await
-			.map_err(|e| {
-				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {e}"))))
+			.map_err(|err| {
+				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {err}"))))
 			})?;
 
 		let keys: PubKeys = [(output.key.to_string(), key.key)].into();
@@ -286,7 +286,7 @@ async fn verify_access_token(
 				ErrorKind::UnknownToken(
 					assign!(UnknownTokenErrorData::new(), { soft_logout: true }),
 				),
-				"This token has expired".into(),
+				"This access token has expired.".into(),
 				StatusCode::UNAUTHORIZED,
 			));
 		}
@@ -321,12 +321,12 @@ async fn verify_access_token(
 				)));
 			}
 		} else {
-			// Otherwise, explicitly if the endpoint is restricted to admins only.
+			// Otherwise, explicitly check if the endpoint is restricted to admins only.
 			if required_scopes.contains(&OAuthScope::ServerAdministration)
 				&& services.users.is_admin(&sender_user).await
 			{
 				return Err!(Request(Forbidden(
-					"Only server administrators can use this endpoint"
+					"Only server administrators can use this endpoint."
 				)));
 			}
 		}
@@ -346,7 +346,7 @@ async fn verify_access_token(
 		};
 
 		if !appservice_info.is_user_match(&sender_user) {
-			return Err!(Request(Exclusive("User is not in namespace.")));
+			return Err!(Request(Exclusive("User is not in this appservice's namespace.")));
 		}
 
 		// MSC3202/MSC4190: Handle device_id masquerading for appservices.
@@ -360,10 +360,7 @@ async fn verify_access_token(
 				.await
 				.is_err()
 			{
-				return Err!(Request(Forbidden(
-					"Device does not exist for user or appservice cannot masquerade as this \
-					 device."
-				)));
+				return Err!(Request(Forbidden("Appservice cannot masquerade as this device.")));
 			}
 
 			Some(device_id.to_owned())
@@ -379,7 +376,7 @@ async fn verify_access_token(
 	} else {
 		Err(Error::Request(
 			ErrorKind::UnknownToken(UnknownTokenErrorData::new()),
-			"Invalid token".into(),
+			"Invalid access token.".into(),
 			StatusCode::UNAUTHORIZED,
 		))
 	}