cosec-troubleshootlisted

# CoSec Troubleshooting Find the first incorrect transition from request parsing to authentication, policy loading, matching, and response mapping. Gather evidence before proposing a policy or code change. ## Start with observable facts Capture the request method/path, response status and CoSec JSON reason, principal ID/authenticated state, app/space/tenant IDs, effective configuration, loaded policy IDs, and relevant startup/request logs. Redact tokens and secrets. Enable focused logging: ```yaml logging: level: me.ahoo.cosec.authorization.SimpleAuthorization: DEBUG me.ahoo.cosec.audit: DEBUG ``` `SimpleAuthorization` identifies the matched policy/statement or role/permission. When `AuditingAuthorization` is active, the default sink emits structured deny events at WARN and allow events at DEBUG, including principal, request, decision, and matched rule when available. A custom `Authorization` bean is not wrapped automatically. ## Interpret the status first | HTTP status | CoSec meaning | |---|---| | 400 | Invalid normalized request path | | 401 | Authorization denied while the parsed principal is anonymous; invalid/expired tokens also fall back to anonymous and preserve the token reason | | 403 | An authenticated principal was denied, or a regex matcher timed out and failed closed | | 429 | A local or Redis rate limiter threw `TooManyRequestsException` | | 500 | Unexpected authorization error; inspect the server exception | The authorization result alone do