[mckaragoz]

Summary

Fixes #101

Fixes CheckAsync to consistently return structured authorization decisions instead of HTTP 403/428 responses.

Changes

• Return AuthorizationResult with HTTP 200 for allowed, denied, and reauthentication-required decisions.
• Preserve appropriate HTTP error responses for invalid or unauthenticated requests.
• Update unit, integration, and client tests.
• Improve documentation explaining CheckAsync usage, response semantics, and security boundaries.

Notes

Authorization denial is now treated as a valid evaluation result rather than a failed API request.

Identity Lab sandbox policy and user creation issues will be addressed separately.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.10%. Comparing base (dcca59e) to head (86242a2).

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #105      +/-   ##
==========================================
- Coverage   86.13%   86.10%   -0.03%     
==========================================
  Files         665      665              
  Lines       18382    18378       -4     
  Branches     2249     2247       -2     
==========================================
- Hits        15833    15825       -8     
- Misses       1795     1803       +8     
+ Partials      754      750       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.