fix(binjovi): one error handler per staging rule, so HTML gets its redirect #118

Merged
binjovi-bot merged 1 commit from feat/binjovi-dev-dashboard-routes into trunk 2026-09-13 12:52:16 +00:00
Owner

Follow-up to #116, found on the first browser probe of https://binjovi.dev/ after binjovi v0.1.716 landed.

Each binjovi-dev-* rule listed two per-rule error handlers: redirect with an HTML when, and json with no condition. Oathkeeper treats a handler without a condition as responsible for every request, so an HTML request found two responsible handlers and answered 500 "Found more than one error handlers to be responsible for this request". A request that was not HTML still got its 401, so the availability gate passed and the staging Deploy went through; only the browser path was broken.

Per the Ory pipeline documentation, per-rule handlers must not overlap, and a request that matches no rule handler falls back to the global list, whose json handler is what gives the 401. So each staging rule now carries only the HTML redirect. The contract refuses a per-rule json handler on the staging twins and explains why. tests/check.sh passes; the six rules parse with exactly [redirect] as their error handlers.

Verified before the change: anonymous curl https://binjovi.dev/ → 401 JSON from Oathkeeper; with Accept: text/html → 500. Expected after: the same 401, and a 302 to https://binjovi.dev/oauth2/start?rd=… for HTML.

https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

Follow-up to #116, found on the first browser probe of `https://binjovi.dev/` after binjovi v0.1.716 landed. Each `binjovi-dev-*` rule listed two per-rule error handlers: `redirect` with an HTML `when`, and `json` with no condition. Oathkeeper treats a handler without a condition as responsible for every request, so an HTML request found two responsible handlers and answered `500 "Found more than one error handlers to be responsible for this request"`. A request that was not HTML still got its 401, so the availability gate passed and the staging Deploy went through; only the browser path was broken. Per the Ory pipeline documentation, per-rule handlers must not overlap, and a request that matches no rule handler falls back to the global list, whose `json` handler is what gives the 401. So each staging rule now carries only the HTML redirect. The contract refuses a per-rule `json` handler on the staging twins and explains why. `tests/check.sh` passes; the six rules parse with exactly `[redirect]` as their error handlers. Verified before the change: anonymous `curl https://binjovi.dev/` → 401 JSON from Oathkeeper; with `Accept: text/html` → 500. Expected after: the same 401, and a 302 to `https://binjovi.dev/oauth2/start?rd=…` for HTML. https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
fix(binjovi): one error handler per staging rule, so HTML gets its redirect
All checks were successful
binjovi/ci Binjovi completed the frozen plan
49dfddb7d1
Each binjovi.dev rule listed a redirect handler for HTML and a json handler
for the rest. Oathkeeper treats a handler with no condition as responsible
for every request, so an HTML request found two responsible handlers and
answered 500 instead of the redirect.

Only the HTML redirect is rule-specific now. A request that is not HTML
matches no rule handler and falls back to the global list, whose json
handler gives the 401 the availability gate expects. The contract refuses a
per-rule json handler on the staging twins.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
binjovi-bot deleted branch feat/binjovi-dev-dashboard-routes 2026-09-13 12:52:16 +00:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/ory!118
No description provided.