From 43ad9287cc063fc6a74e1398a3a8b642631cbcae Mon Sep 17 00:00:00 2001 From: Eugene Blikh Date: Sun, 9 Aug 2026 00:53:12 +0300 Subject: [PATCH] bearer: say what IsRefusal does not answer for A service whose own refusals do not wrap these sentinels sends its "bad token" into the else branch of the guard the doc suggests, and answers 503 to a caller whose credential really was the problem. One of the six hit this while adopting it. --- bearer/status.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/bearer/status.go b/bearer/status.go index dca20fe981b8bbdef523ccd0b2a1201bbd2a21af..8362452d383cbc74548d3c82aaa878426620bf93 100644 --- a/bearer/status.go +++ b/bearer/status.go @@ -66,6 +66,13 @@ func StatusFor(err error) int { // // Without this, each service spells out the sentinel list again, which is the // five-line copy this package exists to stop. +// +// It answers for THIS package's vocabulary and nothing else, which is the trap +// in the guard above: a service whose own refusals do not wrap these sentinels +// sends its "bad token" straight into the else branch and answers 503 to a +// caller whose credential really was the problem. Either wrap — an +// ErrInvalidToken of your own that unwraps to ErrInvalid — or ask your own +// predicate first and reach this one only for what it can have produced. func IsRefusal(err error) bool { for _, sentinel := range []error{ ErrInvalid, ErrNotOurs, ErrForbidden, ErrRevoked, ErrUnavailable,