Observability: log /api/image 401/403 auth-denials to appEvents (category auth/authz, level info) so denial-storms are diagnosable; route currently logs only proxy-failures, not the gate denials

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-14
• wi-cli-venus completed · 4w ago
  Shipped 37979f4 (v2.16.13). /api/image now logs all three auth-gate denials via logAuthz (category authz, level info — NOT error, so gate-correct denials don't inflate error telemetry per PLUTO-482): 401 unauthenticated {reason:unauthenticated}, 403 unowned image id {reason:unownedImageId}, 403 documento-not-owner-or-reviewer {reason:documentoNotOwnerOrReviewer, userId in actorUserId}. reason in detail so denial-storms are filterable. Class-S self-PTD PASS.