mirror of
https://github.com/simstudioai/sim.git
synced 2026-08-31 01:11:53 +08:00
Waleed
93da5d1057
The internal chat error policy rewrites a cross-tenant authorization failure to `Chat not found or access denied`, and says in its own doc that a missing deployment and an unreachable one must stay indistinguishable. The domain answers an absent deployment with its own wording, though, and the policy passed that through — so the editor received `Chat deployment not found` for a deployment that is not there and `Chat not found or access denied` for one it may not reach. Two 404s a caller can tell apart is the existence oracle the concealment exists to close, and because the legacy `code` is derived from the message, it leaked on both fields. Every `not_found` reachable through this policy means the same thing, so the projection now renders all of them as the concealed message. The two existing 404 tests asserted only the status, which is how the bodies drifted apart unnoticed; the new one compares the two responses.