Return 403 from permission error

packages/backend/src/server/oauth/OAuth2ProviderService.ts

@@ -84,6 +84,7 @@ interface ClientInformation {
 	name: string;
 }
 
+// https://indieauth.spec.indieweb.org/#client-information-discovery
 async function discoverClientInformation(httpRequestService: HttpRequestService, id: string): Promise<ClientInformation> {
 	try {
 		const res = await httpRequestService.send(id);

packages/backend/test/e2e/oauth.ts

@@ -553,8 +553,7 @@ describe('OAuth', () => {
 				},
 				body: JSON.stringify({ text: 'test' }),
 			});
-			// XXX: PERMISSION_DENIED is not using kind: 'permission' and gives 400 instead of 403
-			assert.strictEqual(createResponse.status, 400);
+			assert.strictEqual(createResponse.status, 403);
 		});
 	});