A catch-up release rolling up two bugfixes since alpha-39: a request-pipeline fix that stops auth/authorization guards from being bypassed (alpha-41, ZZP-117), and a tenant error-handling fix that stops deliberate domain errors from being flattened into generic 500s (alpha-40, ZZP-99). Both are backward compatible — no config or migration required.
Fixed: enter phase now halts on a :response, not only :halt?
run-enter-phase previously short-circuited the :enter chain only when an interceptor set :halt? true. Guards that reject a request by setting only :response — the auth/authorization guards in boundary.user (require-authenticated, require-admin, require-role, require-tenant-*, and the portal guards downstream) — did not stop the pipeline. The wrapped Ring handler still ran, unauthenticated, and then either overwrote the guard’s rejection with its own 200 or crashed assuming the guard had already rejected.
The enter phase now stops as soon as an interceptor produces a :response, matching standard interceptor semantics (Pedestal / Sieppari): a response terminates the enter chain. :halt? still works for halting without a response, and the :leave phase still runs for the interceptors that executed, so response shapers like security-headers continue to apply.
Blast radius is narrow: the only :enter interceptors that set :response are short-circuit guards (auth / validation / rate-limit) that already intend to stop. Every other :response setter runs in the :leave phase, and the wrapped Ring handler is always the last interceptor — so halting on its response is a no-op.
Fixed: tenant-scoped blocks preserve the domain error type
with-tenant-schema blanket-wrapped every exception thrown inside a tenant-scoped block as {:type :tenant-context-error}, discarding the domain :type (:not-found, :forbidden, :validation-error, :conflict) that HTTP error-mapping layers switch on. A deliberate domain error thrown inside a tenant-scoped block therefore surfaced as a generic 500.
Now a typed ex-info is rethrown unwrapped — its :type reaches the caller. Only a genuinely untyped or infrastructure exception is wrapped as :tenant-context-error, with the original kept as the cause. The classification was extracted into a testable helper.
Version alignment
All 28 libraries bumped to v1.0.1-alpha-41 to maintain lockstep versioning.
Upgrade
Re-run the installer to pick up the latest release:
curl -fsSL https://get.boundary-app.org | bashNo migration required. Both fixes are backward compatible — correctness fixes to existing behaviour, no API or config changes.