Jakub Zych 66fc107eb9 feat: name the missing scope or permission in 403 bodies ...

A refusal by user.scope:<scope> now answers 403 with missing_scope and a
refusal by user.permission:<code> with missing_permission, next to the
unchanged error (true) and message, so a plain-HTTP script or a personal
token client learns what it lacks. user_me says it needs scope read.

2026-10-28 14:05:57 +01:00

..

api_token_test.go

test: expect the missing scope or permission in 403 bodies

2026-10-28 14:05:28 +01:00

api_token.go

feat: name the missing scope or permission in 403 bodies

2026-10-28 14:05:57 +01:00