johannes
96c93c1509
Replaces the 'not in production' note now that 1.3.1 shipped. Written as a do-NOT-reinvent, because the wrong design is the obvious one and was nearly shipped: stamping the MSP's own institution key only works when that key is in the MSP's own granted list. True for QDS in prod, FALSE on bcos.dev (msp1.bcos.dev -> msp1-bcos-dev, not granted, so absent from the JWT). It depended on a data convention; the reporter's email domain is intrinsic to the row. Also records: list and getScoped must stay in step via visibleTo(); every id-taking path is scoped; out-of-tenant reads are 404 not 403; LIKE wildcards escaped because the domain is a JWT claim; the three fail-closed directions incl. the hiveops-incident fail-open precedent; the backfill endpoint; and the prod numbers on the day (49/50 attributed, QDS sees 47).