Migrated from armoriq/conmap-auto#712.
Fix lands in: armoriq/armorcodex. Filed here because conmap-auto is this session's tracker for CLI/SDK work.
armorcodex @ origin/main (72d9e13), plugins/armorcodex/scripts/lib/iap-service.mjs:82-86, 109-111 — a non-2xx response whose body parses as JSON skips the throw, then allowed: data.allowed !== false evaluates to true.
A backend 500 {"error":"db down"} therefore affirmatively authorizes the call (consumed at engine.mjs:508-510, 570).
The sibling verifyWithCsrg (iap-service.mjs:137-155) fails closed, so this is an inconsistency rather than house style.
Ask
Treat any non-2xx as a denial.
Migrated from armoriq/conmap-auto#712.
armorcodex@ origin/main (72d9e13),plugins/armorcodex/scripts/lib/iap-service.mjs:82-86, 109-111— a non-2xx response whose body parses as JSON skips the throw, thenallowed: data.allowed !== falseevaluates totrue.A backend
500 {"error":"db down"}therefore affirmatively authorizes the call (consumed atengine.mjs:508-510, 570).The sibling
verifyWithCsrg(iap-service.mjs:137-155) fails closed, so this is an inconsistency rather than house style.Ask
Treat any non-2xx as a denial.