mirror of
https://github.com/iflytek/skillhub.git
synced 2026-09-06 08:15:57 +00:00
d977ea9dc4
* fix(api): tell callers why a request was forbidden
The scope filter already computes an exact reason ("Missing API token
scope: skill:delete", "API token cannot access endpoint: /x") and the
access-denied handler discarded it, returning a bare "Forbidden" for
every case: missing scope, endpoint closed to API tokens, and paths
that simply don't exist. Clients cannot tell those apart, so they
guess — the published CLI reports every 403 as "token may lack
required scope", which sent us debugging token scopes for an hour when
the real causes were a revoked token and a mistyped namespace path.
The reason now rides in the response via a new error.forbidden.detail
message (en + zh), and is logged alongside the exception type.
Signed-off-by: Gal Eyal <gal.e@popai.health>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(api): safely expose API token denial reasons
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
---------
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
|
||
|---|---|---|
| .. | ||
| auth-commands.test.ts | ||
| auth-resolution.test.ts | ||
| concurrency.test.ts | ||
| cross-command.test.ts | ||
| doctor-command.test.ts | ||
| error-output.test.ts | ||
| help-command.test.ts | ||
| install-command.test.ts | ||
| inventory-resilience.test.ts | ||
| list-command.test.ts | ||
| multi-registry.test.ts | ||
| publish-command.test.ts | ||
| publish-dry-run.test.ts | ||
| remove-command.test.ts | ||
| search-command.test.ts | ||
| update-command.test.ts | ||
| version-command.test.ts | ||
| version-upgrade-flow.test.ts | ||
| whoami-command.test.ts | ||