fix(authz): stop authorizeDecision leaking policy names in 403 bodies

packages/authz/src/advanced.ts

@@ -77,14 +77,26 @@ export function allDecisions<S, R>(...policies: DecisionPolicy<S, R>[]): Decisio
     return allow("all policies passed");
   };
 }
+export interface AuthorizeDecisionOptions {
+  /**
+   * Include `reason` and `policy` in the 403 body. Off by default: policy
+   * names describe internal authorization structure and should not reach an
+   * unauthenticated caller.
+   */
+  exposeReason?: boolean;
+}
+
 export function authorizeDecision(
   evaluate: (ctx: Context) => AuthorizationDecision | Promise<AuthorizationDecision>,
+  options: AuthorizeDecisionOptions = {},
 ): Middleware {
   return async (ctx, next) => {
     const result = await evaluate(ctx);
     if (result.allowed) return next();
     return Response.json(
-      { ok: false, error: "Forbidden", reason: result.reason, policy: result.policy },
+      options.exposeReason
+        ? { ok: false, error: "Forbidden", reason: result.reason, policy: result.policy }
+        : { ok: false, error: "Forbidden" },
       { status: 403 },
     );
   };