Middleware Errors
These are raised before the request reaches the operation, so any call can return them. Both
arrive as the GraphQL error message, and the error object also carries status: 401.
| Error | Meaning |
|---|---|
UNAUTHENTICATED | No valid session token in the Authorization header. |
UNAUTHORIZED | The caller is signed in but lacks the role the call needs — for example a non-admin calling admin_user_requests. |
Two different
unauthorized errorsUNAUTHORIZED (upper case) comes from this middleware and means the wrong role. unauthorized
(lower case) comes from the operations themselves and means the caller can't act on that particular
request — see User Request Errors. Match them as separate codes.
Still to document
- Whether the api-gateway in front of the flight service returns its own errors for an expired or malformed token before this middleware runs.