From b3e8d1e283b1833f19a8cd161007159f1bb143ba Mon Sep 17 00:00:00 2001
From: matevip <matevip@mate.vip>
Date: Sun, 17 May 2026 17:56:03 +0800
Subject: [PATCH] fix(chat): return 401/403 not 500 for chat auth and ownership
 failures

---
 .../main/java/vip/mate/channel/web/ChatController.java    | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/mateclaw-server/src/main/java/vip/mate/channel/web/ChatController.java b/mateclaw-server/src/main/java/vip/mate/channel/web/ChatController.java
index 5d797f8a..1a559102 100644
--- a/mateclaw-server/src/main/java/vip/mate/channel/web/ChatController.java
+++ b/mateclaw-server/src/main/java/vip/mate/channel/web/ChatController.java
@@ -932,7 +932,7 @@ public class ChatController {
         String username = auth != null ? auth.getName() : "anonymous";
         // 权限校验：已认证用户需验证会话归属，匿名用户（permitAll）直接放行
         if (auth != null && !conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权操作该会话");
+            return R.fail(403, "无权操作该会话");
         }
         boolean stopped = streamTracker.requestStop(conversationId);
 
@@ -975,7 +975,7 @@ public class ChatController {
             Authentication auth) {
         String username = auth != null ? auth.getName() : "anonymous";
         if (auth != null && !conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权操作该会话");
+            return R.fail(403, "无权操作该会话");
         }
 
         if (!streamTracker.isRunning(conversationId)) {
@@ -1024,7 +1024,7 @@ public class ChatController {
 
         String username = auth != null ? auth.getName() : null;
         if (username == null) {
-            return R.fail("未登录，请先登录");
+            return R.fail(401, "未登录，请先登录");
         }
         conversationService.getOrCreateConversation(request.getConversationId(), agentId, username, workspaceId);
         conversationService.saveMessage(request.getConversationId(), "user", request.getMessage(), request.getContentParts());
@@ -1047,7 +1047,7 @@ public class ChatController {
         // 校验会话归属（会话可能尚未创建，此时允许上传——后续 stream/chat 会创建并绑定用户）
         if (conversationService.conversationExists(conversationId)
                 && !conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权操作该会话");
+            return R.fail(403, "无权操作该会话");
         }
         if (file.isEmpty()) {
             return R.fail("上传文件不能为空");