From fb136f33ecae16f49eb79492490dd9c299d9ebf7 Mon Sep 17 00:00:00 2001
From: Nora <thatnora@proton.me>
Date: Fri, 15 May 2026 11:53:38 +0200
Subject: [PATCH] fix(server): forward auth error status code to createError

---
 src/runtime/server/services/serverSupabaseSession.ts | 5 ++++-
 src/runtime/server/services/serverSupabaseUser.ts    | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/runtime/server/services/serverSupabaseSession.ts b/src/runtime/server/services/serverSupabaseSession.ts
index c2f873eb7..3b1779f5f 100644
--- a/src/runtime/server/services/serverSupabaseSession.ts
+++ b/src/runtime/server/services/serverSupabaseSession.ts
@@ -8,7 +8,10 @@ export const serverSupabaseSession = async (event: H3Event): Promise<Omit<Sessio
 
   const { data: { session }, error } = await client.auth.getSession()
   if (error) {
-    throw createError({ statusMessage: error?.message })
+    throw createError({
+      statusCode: error.status ?? 500,
+      statusMessage: error.message,
+    })
   }
 
   // @ts-expect-error we need to delete user from the session object here to suppress the warning coming from GoTrueClient
diff --git a/src/runtime/server/services/serverSupabaseUser.ts b/src/runtime/server/services/serverSupabaseUser.ts
index 691fefb8f..e15be0ac2 100644
--- a/src/runtime/server/services/serverSupabaseUser.ts
+++ b/src/runtime/server/services/serverSupabaseUser.ts
@@ -8,7 +8,10 @@ export const serverSupabaseUser = async (event: H3Event): Promise<JwtPayload | n
 
   const { data, error } = await client.auth.getClaims()
   if (error) {
-    throw createError({ statusMessage: error?.message })
+    throw createError({
+      statusCode: error.status ?? 500,
+      statusMessage: error.message,
+    })
   }
 
   return data?.claims ?? null