Jakub Zych e7630e6762 fix(19.7): RA-WR-03 a guard error while re-filtering no longer narrows a session ...

catalog.allowedReport returns the allowed lists together with the first
provider error. Widening (stateful) and the stateless refresh leave the
cached server and its recorded fingerprint untouched on an error, so the
next request retries instead of the tools staying hidden until the next
rotation or event. A fan-out recompute still applies its fail-closed diff
but records no fingerprint, so the binding's next request re-filters.

TestWideningGuardError fails the guard during a widening on both paths and
during a permissions recompute, then asserts that the next request lists
every tool once the provider answers again.

2026-10-23 20:07:51 +02:00

10 KiB

Raw Blame History

View Raw