1 files changed, 7 insertions(+), 0 deletions(-)

M bearer/status.go

@@ 66,6 66,13 @@ func StatusFor(err error) int {
 //
 // Without this, each service spells out the sentinel list again, which is the
 // five-line copy this package exists to stop.
+//
+// It answers for THIS package's vocabulary and nothing else, which is the trap
+// in the guard above: a service whose own refusals do not wrap these sentinels
+// sends its "bad token" straight into the else branch and answers 503 to a
+// caller whose credential really was the problem. Either wrap — an
+// ErrInvalidToken of your own that unwraps to ErrInvalid — or ask your own
+// predicate first and reach this one only for what it can have produced.
 func IsRefusal(err error) bool {
 	for _, sentinel := range []error{
 		ErrInvalid, ErrNotOurs, ErrForbidden, ErrRevoked, ErrUnavailable,