erroring on the server works from now on

Cargo.lock

@@ -7031,6 +7031,7 @@ dependencies = [
  "tower",
  "tracing",
  "tracing-subscriber",
+ "trait-variant",
  "tui-canvas-validation-core",
  "unicode-width 0.2.2",
  "url",
@@ -8542,6 +8543,17 @@ dependencies = [
  "tracing-log",
 ]
 
+[[package]]
+name = "trait-variant"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b19a4867a870f6edc4c283f2b455804b1879c0baf0e642f26b03ed8ee262d9d3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "try-lock"
 version = "0.2.5"

common/proto/auth.proto

@@ -35,7 +35,7 @@ service AuthService {
   rpc ListRolePermissions(ListRolePermissionsRequest) returns (RolePermissions);
   rpc ListGrantableObjects(ListGrantableObjectsRequest) returns (ListGrantableObjectsResponse);
 
-  // Support diagnostics. Requires read on diagnostics:internal-errors.
+  // Diagnostic browsing is admin-only; authenticated UUID lookup follows role restrictions.
   rpc ListInternalErrors(ListInternalErrorsRequest) returns (ListInternalErrorsResponse);
   rpc GetInternalError(GetInternalErrorRequest) returns (InternalError);
 

common/src/proto/komp_ac.auth.rs

@@ -846,7 +846,7 @@ pub mod auth_service_client {
                 );
             self.inner.unary(req, path, codec).await
         }
-        /// Support diagnostics. Requires read on diagnostics:internal-errors.
+        /// Diagnostic browsing is admin-only; authenticated UUID lookup follows role restrictions.
         pub async fn list_internal_errors(
             &mut self,
             request: impl tonic::IntoRequest<super::ListInternalErrorsRequest>,
@@ -1070,7 +1070,7 @@ pub mod auth_service_server {
             tonic::Response<super::ListGrantableObjectsResponse>,
             tonic::Status,
         >;
-        /// Support diagnostics. Requires read on diagnostics:internal-errors.
+        /// Diagnostic browsing is admin-only; authenticated UUID lookup follows role restrictions.
         async fn list_internal_errors(
             &self,
             request: tonic::Request<super::ListInternalErrorsRequest>,