Marc-André Bombeck 984a75d036 fix(api): name the private-origin refusal on webhook and ntfy routes ...

The save routes evaluate the same policy the senders do. A target on a
private network the operator has not listed is a 422 with
meta.errorCode = private_origin_not_approved and a message that names
NOTIFICATION_PRIVATE_ORIGINS, instead of the generic "Invalid data"; a
listed private address saves although the plain public floor would
have refused it. The settings schemas take the target predicate as a
parameter so the validator module never reads the environment; the
exported constants keep the public floor for the OpenAPI contract.

The test routes forward the sender's refusal as the same 422 and code
instead of a bare 500, so the card can say why the test failed rather
than sending the operator to the wide-event log. A delivery fault is
still a 500. Both test routes and the dispatcher reach the same sender
function, and a structural test holds them there.

The OpenAPI descriptions name the code on all four routes; the test
button's error map gains the code in every locale.

Refs #947

2026-09-10 16:46:13 +02:00

..

__tests__

Settle the suite-wide fallout of the wave

2026-08-14 06:37:30 +02:00

routes

fix(api): name the private-origin refusal on webhook and ntfy routes

2026-09-10 16:46:13 +02:00

registry.ts

feat(api): publish retirement in the contract, the capability read, and the coverage guard

2026-08-23 14:06:52 +02:00