Record access-rule SQL errors are surfaced as Forbidden

[royalcala]

Problem

When record-level access rules fail to evaluate due to SQL/runtime errors, the request can end up as Forbidden, which is indistinguishable from a real authorization denial.

Why this matters

• makes debugging access rules difficult
• misleads clients and operators into thinking ACL denied the request
• hides actionable runtime failures

Expected behavior

• keep Forbidden only for actual permission denial
• surface evaluation failures as internal errors with a stable machine-readable code
• preserve safe error-message behavior in non-dev mode

Scope

Affects record access checks and subscription access checks (HTTP/SSE/WS).

[ignatz]

Hey @royalcala ,

thanks for filing the issue and the PR. A few thoughts (I can be convinced otherwies), this was actually an intentional choice on my end. I didn't think that ACL check issues in production should be very debuggable (and this may just be a security by obscurity argument) but you can easily imagine a world where someone defines an ACL query that fails or is invalid for certain inputs, in which case some level of information may be extracted about the rules at play. My hunch back then was that ideally ACL rules should be robust but when they failed or are deliberately probed they may give information e.g. to the logs but not necessarily to the prober. WDYT?