mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zooqueenandHanzo Dev
25262baa1d
Every hk- in the docs, the widget refusal messages and the fixture tokens named a shape that authenticates nothing. Cloud accepts pk- and sk- and nothing else, IAM mints sk-, and no generator in the fleet still produces hk- — so a reader who copied one of these examples got a 401 and no way to see why. The predicate keeps it. authz.IsAPIKey still matches hk-, and should: those keys are still in circulation and have to reach the backend that refuses them rather than be parsed here as a JWT. TestIsAPIKey pins that row, and the two comments annotating the predicate now mark the shape retired rather than list it alongside the current ones. Where the hk- row sat in the forged-header and widget-key tables, pk- takes its place. sk- was already covered in both, and pk- — the shape that ships in a browser bundle — is the one neither table had ever exercised. Verified: make test, 489 pass / 0 fail, including all four param_forwarding fixtures whose bearer changed. Co-authored-by: Hanzo Dev <[email protected]>