Errors (i.e. 401) not returned

It looks to me that this part is not yet implemented:

def jwt_required(fn):
    @wraps(fn)
    def wrapper(*args, **kwargs):
        jwt_data = _decode_jwt_from_request(request_type='access')
        ctx_stack.top.jwt = jwt_data
        _load_user(jwt_data[config.identity_claim])
        return fn(*args, **kwargs)
    return wrapper

The upper code raises many different exceptions, but I don't see any code returning the errors (my own default error handling of restplus triggers 500 error every time).

The documentation states that:

If the access token is not valid for any reason (missing, expired, tampered with, etc) we will return json in the format of {‘msg’: ‘why accessing endpoint failed’} along with an appropriate http status code (generally 401 or 422).

Default callbacks are all provided, but never returned.

Am I wrong?

Thanks,
Meir Tseitlin

Start at the jwt_required wrapper shown in the issue and trace the exceptions raised by _decode_jwt_from_request and _load_user. Check how the documented default callbacks are intended to be reached; done means invalid access tokens return the documented JSON message with an appropriate 401 or 422 status instead of a 500 response.