mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 23:31:31 +02:00
The access gate, the refresh gate and the two-factor gate each decoded `sub`, parsed the UUID, loaded the user and raised the same three 401s. They had already started to drift: two checked the row exists, the third folded is_active into the same answer. deps.user_for_payload() holds the step and each gate keeps the rule that is its own — refresh answers 403 for an inactive account, two-factor answers 401. Responses are unchanged. Exercised: login, me, refresh, me again, and a malformed bearer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DafWxfoWZXVDgr9KroJBDZ
The file is empty.