mirror of
https://github.com/hanzoai/chat.git
synced 2026-09-30 20:51:17 +00:00
zooqueen
33c6d948d5
Six cases, and the refusals are the point — a forged token has to be a 401 and not a 500, a request with no bearer must never reach the verifier, and a provider conflict stays a 403 rather than being reported as a bad token. Also pins that the token the caller presented is the one handed on for the calls made on their behalf, which is what keeps the two principals the same by construction.