[kvlonge]

Why

Security fix. A refused request named the nodes the caller lacked permission on. Some of those nodes the caller could not see at all: a whole location, or a job's or trigger's write set. Refusals also read differently for existing and unknown locations, jobs and triggers, so a signed-in person could list another location's nodes or probe which objects exist.

Changes

• Every person authorization refusal now returns fixed text per action, such as missing view permission for this target, plus the decision ID. It names no nodes and gives no count. This covers listings, check SQL and evidence, job runs, trigger pause and resume, sensor cursor reset, cancel and rerun.
• An unknown location, job, trigger or run is refused only after authorization runs over the target. It gets the same status, body and headers as a forbidden one, apart from the decision ID and date, and both are audited.
• The audit event still records the scope and the missing nodes for operators.
• The server docs describe the new denial text.
• No DuckShop case is added, because this changes HTTP authorization responses, not a project shape, data value or lifecycle.

Verification

• New test on SQLite and PostgreSQL. It covers 8 location reads (partial viewer, unassigned location, unknown location) and job run, trigger pause, sensor reset, cancel and rerun (forbidden vs unknown). It checks:
  • no node key appears in any body;
  • responses are identical after masking the UUID and date;
  • every refusal is audited with the detail.
• The new test fails on the previous code, and fails again when the unknown-trigger refusal is removed.
• Updated the Rust, Python and TypeScript tests that asserted the old text; they pass against this branch's server.
• make check-ci passes.