{"record":{"id":"fe530f7a0724a484","repo":"ruvnet/ruflo","slug":"inbound-authorization-would-deny-message-type-f","errorCode":null,"errorMessage":"Inbound authorization would deny ${message.type} from ${sourceNodeId} (mode=${authorizationMode})","messagePattern":"Inbound authorization would deny (.+?) from (.+?) \\(mode=(.+?)\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts","lineNumber":446,"sourceCode":"    deps.logger.warn('Inbound rejected: enforce mode has no authorization evaluator');\n    return { accepted: false, reason: 'AUTHORIZATION_ERROR' };\n  }\n\n  if (authorizationDecision && !authorizationDecision.allowed) {\n    if (authorizationMode === 'enforce') {\n      await deps.audit.log('message_rejected', {\n        sourceNodeId,\n        metadata: {\n          address,\n          reason: 'AUTHORIZATION_DENIED',\n          messageType: message.type,\n          policyReason: authorizationDecision.reason,\n        },\n      });\n      deps.logger.warn(`Inbound authorization denied for ${sourceNodeId} (addr=${address})`);\n      return { accepted: false, reason: 'AUTHORIZATION_DENIED' };\n    }\n    deps.logger.warn(\n      `Inbound authorization would deny ${message.type} from ${sourceNodeId} ` +\n        `(mode=${authorizationMode})`,\n    );\n  }\n\n  // Touch lastSeen on every successful inbound — drives the\n  // discovery service's stale-peer detection.\n  peer.markSeen();\n\n  // Audit accepted delivery\n  await deps.audit.log('message_received', {\n    sourceNodeId,\n    metadata: {\n      address,\n      messageType: message.type,\n      messageId: message.id,\n      authorizationMode,\n      authorizationAllowed: authorizationDecision?.allowed,","sourceCodeStart":428,"sourceCodeEnd":464,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts#L428-L464","documentation":"Dry-run counterpart of the enforce denial: the evaluator decided a message of this type from this node would be denied, but the plugin is in observe/legacy mode, so the message is still dispatched. The warn exists to preview which traffic enforce mode will reject once activated.","triggerScenarios":"Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:446 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Review the authorization policy; in observe mode the would-deny is logged so policy can be tuned before enforce is enabled."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}