main(): Respond with 403 by default

Previously we were responding with a 200 if all else checked out. This
seems too permissive. Only the authorised webhook requester should
receive a 200. All other requesters should be denied access. Swap the
last two responses to reflect this.

1 files changed, 4 insertions, 4 deletions

diff --git a/license-generator/src/main.rs b/license-generator/src/main.rs
index bd8b192..477ebf4 100644
--- a/license-generator/src/main.rs
+++ b/license-generator/src/main.rs
@@ -104,19 +104,19 @@ fn main() -> Result<()> {
             },
         };
 
-        if !is_verified {
-            response::set_403(&mut req.stdout()).unwrap_or(());
+        if is_verified {
             write!(&mut req.stdout(), "Content-Type: text/plain
 
-403 Forbidden: Invalid request signature")
+    200 OK")
                 .unwrap_or(());
 
             return;
         }
 
+        response::set_403(&mut req.stdout()).unwrap_or(());
         write!(&mut req.stdout(), "Content-Type: text/plain
 
-200 OK")
+403 Forbidden: Invalid request signature")
             .unwrap_or(());
     });