Files
sim/apps
Waleed 083319be8b fix(api): conceal cross-tenant resource denials on internal routes (#6586)
The v2 routes rewrite DelegatedWorkspaceAuthorizationError,
NoWorkspaceAccessError, and WorkspaceApiKeyScopeAuthorizationError to a
404 so a caller with no reach into a workspace cannot confirm a
resource exists. The internal routes reach the same application use
cases and still answered 403, so the same probe worked from the other
surface. Same-workspace role denials stay 403 on both.
2026-08-11 19:50:04 -07:00
..