Files
deepseek-harness/packages/api/session-controller/tests
mektpoy 44f0996974 fix(session-controller): ask the concrete access decision before cancelling
The recheck used allows(), the list-filter view that never sees call arguments,
so a policy narrowing cancel to args.request refused a legitimate caller as
access-withdrawn forever. Ask decide() with the principal and the request, keep
the policy's own refusal reason, and cover both an args-independent role and an
args-dependent condition.
2026-10-22 21:44:24 +08:00
..