Login with different actor type still get 200 response

[ccwei]

I have different actor types setup, i noticed that when i call /auth/{actortype}/emailpass endpoint, as long as the email/password is correct, regardless of actor type, it returns 200 response. I'm wondering if this is expected behavior?
I have two different log in portal portals for two different actor types, currently i'm not able to distinguish if the user is logged in successfully with the actor type since it returns 200 as long as the credentials match.

[ahgentil]

I just noticed the same issue.
I can login with the credentials of a 'manager' user using the endpoint /auth/customer/emailpass, and still get a 200 and the token.
Or, login with the credentials of a 'customer' user using the endpoint /auth/manager/emailpass, and get 200 and the token.
It's true that all subsequent requests to other API endpoints fail, because the middleware blocks it (authenticate("manager", ["session", "bearer"])), but I would say that these requests should not return the token and should fail.