Release v20.58.1
Fixed
- A command that fails role authorization now returns
403 Forbiddeneven when the command is also invalid, instead of a400validation error.
Security
- Validation detail is no longer returned to a caller who is not authorized for a command endpoint — authorization is decided before validation runs.