Week 3 Boss Fight · Incident #IDENTITY-03

Login succeeds but protected API returns 403

A demo user completes login and receives a token, yet the protected purchase endpoint returns 403. Do not disable the Backend guard or grant broad roles.

AVAILABLE TO READ · LOCKED FOR PASS

Scenario and known facts are readable. Assistance and attempts unlock after the previous Week Gate passes.

KNOWN FACTS
  • • OIDC login succeeds
  • • The API validates the token enough to distinguish it from 401
  • • The expected role must be enforced by Backend
Attempt form is locked for progression integrity.