authz-bridging-exceptions

Replace inspect.isawaitable with inspect.iscoroutine when checking the evaluate closure. isawaitable returns True for async def functions, and awaiting the function itself yields None instead of its return value, causing a TypeError when the result is later called.

The auth override branch may be masking authorization failures when dependency_overrides patches get_evaluate_policy with a function returning True. Ensure the fallback only triggers on genuine 401 credential failures and that 403 signals propagate unchanged.

iscoroutine is True only for coroutine objects, while isawaitable is also True for coroutine functions and other awaitables. Awaiting an async def function object returns None rather than calling it, so iscoroutine is the safe check before awaiting.

Run grep -rn "if inspect.isawaitable" on your backend source and check whether each match sits inside an if-override-is-not-None fallback block. Refactor each matching branch to use inspect.iscoroutine for the post-override check.

The SA fallback should only trigger on 401, meaning genuine missing or invalid credentials. It must not mask 403 responses such as must_change_password or other 4xx and 5xx signals, which are authorization or server-state errors that must reach the client unchanged.