Return 401 for invalid link-checker-api webhook signature

A correctly-formed request with the wrong signature is an
authentication failure, not a malformed request.

Author: TonyGDS

app/controllers/admin/link_checker_api_controller.rb

@@ -25,7 +25,7 @@ def verify_signature
 
     body = request.raw_post
     signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha1"), webhook_secret_token, body)
-    head :bad_request unless Rack::Utils.secure_compare(signature, given_signature)
+    head :unauthorized unless Rack::Utils.secure_compare(signature, given_signature)
   end
 
   def webhook_secret_token

test/functional/admin/link_checker_api_controller_test.rb

@@ -57,13 +57,13 @@ def generate_signature(body, key)
     assert_response :bad_request
   end
 
-  test "POST :callback returns 400 when the signature does not match the body" do
+  test "POST :callback returns 401 when the signature does not match the body" do
     LinkCheckerApiReport.any_instance.expects(:mark_report_as_completed).never
 
     body = link_checker_api_batch_report_hash(id: 5, links: [{ uri: @link, status: "ok" }])
     request.headers["X-LinkCheckerApi-Signature"] = generate_signature(body.to_json, "wrong-secret")
     post :callback, params: body
 
-    assert_response :bad_request
+    assert_response :unauthorized
   end
 end