diff --git a/server/src/__tests__/board-access-denial.test.ts b/server/src/__tests__/board-access-denial.test.ts index d8217041624..c545fa7831c 100644 --- a/server/src/__tests__/board-access-denial.test.ts +++ b/server/src/__tests__/board-access-denial.test.ts @@ -51,6 +51,7 @@ describe("board-only denial", () => { expect(res.body.code).toBe(BOARD_ACCESS_REQUIRED_CODE); expect(res.body.remediation).toContain("this denial is final"); expect(res.body.remediation).toContain("do not search for one"); + expect(res.body.remediation).toContain("reply now"); expect(res.body.remediation).toContain(link); }); diff --git a/server/src/routes/authz.ts b/server/src/routes/authz.ts index 9b16388328e..7be801f0faa 100644 --- a/server/src/routes/authz.ts +++ b/server/src/routes/authz.ts @@ -98,7 +98,7 @@ export function boardAccessRequired(req: Request) { : "They can do it in the Paperclip web app or with their own board credentials. Link a page only if you already know its route; do not search for one."; return forbidden("Board access required", { code: BOARD_ACCESS_REQUIRED_CODE, - remediation: `This action is board-only by design and this denial is final: no agent credential, tool or other API route can do it, so do not search for one. Tell the person that a board user must do it. ${where}`, + remediation: `This action is board-only by design and this denial is final: no agent credential, tool or other API route can do it, so do not search for one. Stop working on this step and reply now: tell the person that a board user must do it. ${where}`, }); }