Course creation: validation errors return to unauthorized user

[plushkinaaa]

Steps to reproduce

1. Send post request http://qa-school-test.quantori.academy/api/v1/courses without body
   Actual behavior

{
    "errors": [
        {
            "msg": "Please send required fields: title,categoryId",
            "param": "title",
            "location": "body"
        },
        {
            "msg": "Please send required fields: title,categoryId",
            "param": "categoryId",
            "location": "body"
        },
        {
            "msg": "Parameter should be a string",
            "param": "title",
            "location": "body"
        },
        {
            "msg": "Minimum course title length is: 3",
            "param": "title",
            "location": "body"
        },
        {
            "msg": "You are not allowed to use spaces only",
            "param": "title",
            "location": "body"
        },
        {
            "msg": "Parameter should be a string",
            "param": "description",
            "location": "body"
        },
        {
            "msg": "Minimum course description length is: 3",
            "param": "description",
            "location": "body"
        },
        {
            "msg": "Parameter should be boolean",
            "param": "visible",
            "location": "body"
        },
        {
            "msg": "Parameter should be numeric",
            "param": "categoryId",
            "location": "body"
        },
        {
            "msg": "Unable to find category record(s)",
            "param": "categoryId",
            "location": "body"
        }
    ]
}

Expected behavior

{
    "errors": "Unauthorized"
}

[viraxslot]

@plushkinaaa endpoint checks are organized in this way:

1. Check the request body (apply validations)
2. Check the JWT (authenticated or not)
3. Check permissions (forbidden or not)

So it's the expected error.
Why do you think we need to check the token first?