route-proxy: a policy refusal is also not-my-token #67

2026-09-26T12:26:09Z

jschoubben commented

2026-09-26 12:26:09 +00:00

autocert checks the host policy before the token and answers 403 — the internal authority does this for every public name, so mail.novox.be's challenge died on the internal manager's probe one commit after it stopped dying on the public one's 404 (found live: the fall-through returned the internal policy's own "no internal-only route" text). Both shapes of refusal now fall through to routing; a fifth test pins the 403 case with a refusing policy.

autocert checks the host policy *before* the token and answers 403 — the internal authority does this for every public name, so `mail.novox.be`'s challenge died on the internal manager's probe one commit after it stopped dying on the public one's 404 (found live: the fall-through returned the internal policy's own "no internal-only route" text). Both shapes of refusal now fall through to routing; a fifth test pins the 403 case with a refusing policy.

jschoubben added 1 commit 2026-09-26 12:26:09 +00:00

route-proxy: a policy refusal is also not-my-token dad0a153ff

autocert checks the host policy before the token and answers 403 — the
internal authority does this for every public name, so mail.novox.be's
challenge died on the internal manager's probe one commit after it
stopped dying on the public one's 404. Both shapes of refusal now fall
through to routing; a fifth test pins the 403 case with a refusing
policy.

jschoubben merged commit 41de152739 into main

2026-09-26 12:26:19 +00:00

jschoubben deleted branch fix/a-policy-refusal-is-also-not-my-token

2026-09-26 12:26:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#67