From 09bf0a194795286dd102f6138f470bee045777f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Sat, 8 Aug 2026 12:30:13 +0200
Subject: [PATCH] fix(openapi): publish the sharing refusal on the prognosis
 read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every delegable operation states, in the contract, that it can refuse a
delegate — and the guard over the document caught this one publishing
only its module gate. One status, two reasons: the module gate's own
sentence first, the shared refusal spliced on the end, which is the
shape every other gated delegable route already uses.
---
 docs/api/openapi.yaml          | 1 +
 src/lib/openapi/routes/mood.ts | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index 2c66a7945..eda8dc2a5 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -8377,6 +8377,7 @@ paths:
               schema:
                 $ref: "#/components/schemas/MoodPrognosisEnvelope"
         "401": *a1
+        "403": *a7
         "422": *a3
         "429": *a4
   /api/mood-entries/bulk:
diff --git a/src/lib/openapi/routes/mood.ts b/src/lib/openapi/routes/mood.ts
index a562f05fc..7589199e4 100644
--- a/src/lib/openapi/routes/mood.ts
+++ b/src/lib/openapi/routes/mood.ts
@@ -35,7 +35,9 @@ import {
 import {
   dataEnvelope,
   errorEnvelope,
+  recordRefusal,
   stdResponses,
+  MODULE_DISABLED_DESCRIPTION,
   baseUpdatedAtField,
   updatedAtTokenField,
   conflictResponse409,
@@ -510,6 +512,9 @@ export const moodPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             },
           },
         },
+        // Two reasons, one status: the module gate and the sharing fence both
+        // answer 403, and OpenAPI allows one response per status.
+        ...recordRefusal(MODULE_DISABLED_DESCRIPTION),
         ...stdResponses,
       },
     },