gale-popai d977ea9dc4 fix(api): tell callers why a request was forbidden (#610) ... * fix(api): tell callers why a request was forbidden The scope filter already computes an exact reason ("Missing API token scope: skill:delete", "API token cannot access endpoint: /x") and the access-denied handler discarded it, returning a bare "Forbidden" for every case: missing scope, endpoint closed to API tokens, and paths that simply don't exist. Clients cannot tell those apart, so they guess — the published CLI reports every 403 as "token may lack required scope", which sent us debugging token scopes for an hour when the real causes were a revoked token and a mistyped namespace path. The reason now rides in the response via a new error.forbidden.detail message (en + zh), and is logged alongside the exception type. Signed-off-by: Gal Eyal <gal.e@popai.health> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): safely expose API token denial reasons Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>		2026-07-28 17:42:20 +08:00
..
fake-registry.ts	fix(api): tell callers why a request was forbidden (#610)	2026-07-28 17:42:20 +08:00
run-cli.ts	test(cli): add comprehensive integration tests and fix update command bugs	2026-05-07 14:46:40 +08:00
temp-env.ts	feat(cli): add SkillHub CLI v1 with full command suite	2026-04-29 15:37:04 +08:00