fix: preserve tenant creation metadata and report authority denial

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_web.py

@@ -6,6 +6,10 @@ import unittest
 from dataclasses import replace
 from datetime import timedelta
 from urllib.parse import quote, urlencode
+from urllib.error import HTTPError
+from unittest.mock import patch
+
+from user_engine.adapters.tenant_management import HTTPTenantManagementAdapter
 
 from user_engine.adapters import InMemoryUserEngineStore, LocalAuthorizationCheckPort
 from user_engine.domain import (
@@ -898,6 +902,37 @@ class PortalApplicationTests(unittest.TestCase):
         )
         self.assertIn(b"Manage an existing tenant", html)
 
+    def test_platform_tenant_authority_denial_is_redacted_and_creates_no_admin(self):
+        oidc = OIDCClient(
+            issuer="https://kc.example", client_id="portal",
+            redirect_uri="https://users.example/oidc/callback", audience="portal",
+        )
+        oidc.sessions["platform"] = BrowserSession(
+            claims=self.platform_claims(), expires_at=9999999999,
+            csrf_token="platform-csrf",
+        )
+        self.app.oidc_client = oidc
+        self.app.tenant_management = HTTPTenantManagementAdapter(
+            base_url="https://tenants.example", bearer_token="test-service-boundary",
+        )
+        failure = HTTPError(
+            "https://tenants.example/tenants", 403, "Forbidden", {},
+            io.BytesIO(b'{"error_code":"write_denied","detail":"private-policy-detail"}'),
+        )
+        with patch("user_engine.adapters.tenant_management.urlopen", side_effect=failure), \
+                patch.object(self.app.service, "create_user") as create_user:
+            response, payload = invoke(
+                self.app, "/platform/tenants", method="POST",
+                cookie="ue_session=platform", form={
+                    "csrf_token": "platform-csrf", "tenant": "tenant:trial:demo-company",
+                    "admin_display_name": "First Admin", "admin_email": "admin@example.test",
+                },
+            )
+        self.assertEqual("403 Forbidden", response["status"])
+        self.assertNotIn(b"provisioning_unavailable", payload)
+        self.assertNotIn(b"private-policy-detail", payload)
+        create_user.assert_not_called()
+
     def test_platform_browser_tenant_and_first_admin_bootstrap(self):
         claims = self.platform_claims()
         oidc = OIDCClient(