feat: more accurate status codes

403 Forbidden replacing many 401 Unauthorized usages.

src/utils.py

@@ -1,9 +1,8 @@
 from datetime import datetime, timezone
 from joserfc import jwt, jwk, errors
 
-from src.auth.exceptions import UnauthorizedException
 from src.config import settings
-
+from src.exceptions import ForbiddenException, UnauthorizedException
 
 KEY = jwk.import_key(settings.SECRET_KEY.get_secret_value(), "oct")
 
@@ -33,7 +32,7 @@ async def verify_email_token(user_model, token):
 		raise UnauthorizedException("Invitation expired.")
 
 	if user_model.email != claimed_email:
-		raise UnauthorizedException("The logged in user and email do not match.")
+		raise ForbiddenException("The logged in user and email do not match.")
 
 	return email_claims