From 3dd940d4cbd72afed38eba49b557823a6a55eac2 Mon Sep 17 00:00:00 2001
From: Nihad Abbasov <narkoz.2008@gmail.com>
Date: Thu, 20 Sep 2012 08:36:43 -0700
Subject: [PATCH 1/3] API: extend UserLogin entity from UserBasic

---
 lib/api/entities.rb | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 5d8cc2765b1..a8b786aebb0 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -9,8 +9,8 @@ module Gitlab
       expose :id, :email, :name, :blocked, :created_at
     end
 
-    class UserLogin < Grape::Entity
-      expose :id, :email, :name, :private_token, :blocked, :created_at
+    class UserLogin < UserBasic
+      expose :private_token
     end
 
     class Hook < Grape::Entity
@@ -56,9 +56,7 @@ module Gitlab
     end
 
     class Key < Grape::Entity
-      expose  :id,
-              :title,
-              :key
+      expose  :id, :title, :key
     end
   end
 end

From b08d33f6a9a82e04f288fc0a4de6d4a7489795e1 Mon Sep 17 00:00:00 2001
From: Nihad Abbasov <narkoz.2008@gmail.com>
Date: Thu, 20 Sep 2012 08:38:08 -0700
Subject: [PATCH 2/3] API: return 401 for invalid session

---
 lib/api/session.rb                | 5 ++---
 spec/requests/api/session_spec.rb | 4 ++--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/lib/api/session.rb b/lib/api/session.rb
index 5bcdf93abe9..b4050160ae4 100644
--- a/lib/api/session.rb
+++ b/lib/api/session.rb
@@ -8,14 +8,13 @@ module Gitlab
     post "/session" do
       resource = User.find_for_database_authentication(email: params[:email])
 
-      return forbidden! unless resource
+      return unauthorized! unless resource
 
       if resource.valid_password?(params[:password])
         present resource, with: Entities::UserLogin
       else
-        forbidden!
+        unauthorized!
       end
     end
   end
 end
-
diff --git a/spec/requests/api/session_spec.rb b/spec/requests/api/session_spec.rb
index 0809475be81..f251f3921ac 100644
--- a/spec/requests/api/session_spec.rb
+++ b/spec/requests/api/session_spec.rb
@@ -19,7 +19,7 @@ describe Gitlab::API do
     context "when invalid password" do
       it "should return authentication error" do
         post api("/session"), email: user.email, password: '123'
-        response.status.should == 403
+        response.status.should == 401
 
         json_response['email'].should be_nil
         json_response['private_token'].should be_nil
@@ -29,7 +29,7 @@ describe Gitlab::API do
     context "when empty password" do
       it "should return authentication error" do
         post api("/session"), email: user.email
-        response.status.should == 403
+        response.status.should == 401
 
         json_response['email'].should be_nil
         json_response['private_token'].should be_nil

From 81aeac46d63cd315b6545494cfa41ae163cadc5c Mon Sep 17 00:00:00 2001
From: Nihad Abbasov <narkoz.2008@gmail.com>
Date: Thu, 20 Sep 2012 08:51:26 -0700
Subject: [PATCH 3/3] update help section with session API docs

---
 app/views/help/api.html.haml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/app/views/help/api.html.haml b/app/views/help/api.html.haml
index 35176f8e214..b1916110ca5 100644
--- a/app/views/help/api.html.haml
+++ b/app/views/help/api.html.haml
@@ -13,6 +13,8 @@
     %a{href: "#snippets"} Snippets
   %li
     %a{href: "#users"} Users
+  %li
+    %a{href: "#session"} Session
   %li
     %a{href: "#issues"} Issues
   %li
@@ -58,6 +60,16 @@
 
 %br
 
+.file_holder#session
+  .file_title
+    %i.icon-file
+    Session
+  .file_content.wiki
+    = preserve do
+      = markdown File.read(Rails.root.join("doc", "api", "session.md"))
+
+%br
+
 .file_holder#issues
   .file_title
     %i.icon-file