// A 403 written by API Gateway itself (it alone sets `x-amzn-errortype`) means the authorizer refused this
// identity for that route. Usually the role just may not use it; sometimes the person has been removed from
// the practice mid-session. HttpService announces each one so the tenant check can find out which.
export const GATEWAY_REFUSED_EVENT = 'akashic:gateway-refused';

export function noteGatewayRefusal(status: number, awsErrorType: string | undefined): void {
    if (status !== 403 || !awsErrorType || awsErrorType.trim() === '') return;
    try {
        window.dispatchEvent(new Event(GATEWAY_REFUSED_EVENT));
    } catch {
        // No window (tests, workers): nothing is listening anyway.
    }
}