Problem
Write endpoints (/v1/ledger/.../instances/{id}, /v2/ledger/.../instances/{id},
/v3/ledger/cloudevents) return 403 when a request has no Authorization header,
instead of 401.
newPolicyMiddleware (internal/middleware/policy.go, ~line 217) forwards the
request to the policy evaluator with an empty API key even when no header was
sent. The evaluator denies it and returns 403, which gets relayed as-is.
No credentials at all should be 401, not 403. This also wastes a network call
to the evaluator on every unauthenticated request.
Fix
Return 401 immediately when Authorization is missing, unless JWT claims are
already in request context (managed-mode JWT-then-policy chain clears the
header after local verification, so that path must not be affected).
Read endpoints may rely on PDP-decided anonymous access; don't remove that.
Problem
Write endpoints (
/v1/ledger/.../instances/{id},/v2/ledger/.../instances/{id},/v3/ledger/cloudevents) return 403 when a request has noAuthorizationheader,instead of 401.
newPolicyMiddleware(internal/middleware/policy.go, ~line 217) forwards therequest to the policy evaluator with an empty API key even when no header was
sent. The evaluator denies it and returns 403, which gets relayed as-is.
No credentials at all should be 401, not 403. This also wastes a network call
to the evaluator on every unauthenticated request.
Fix
Return 401 immediately when
Authorizationis missing, unless JWT claims arealready in request context (managed-mode JWT-then-policy chain clears the
header after local verification, so that path must not be affected).
Read endpoints may rely on PDP-decided anonymous access; don't remove that.