August 20: Some API endpoints briefly rejected flyctl requests

#August 20: Some API endpoints briefly rejected flyctl requests (14:46UTC)

We deployed a change to one of our API backends to reject authentication using legacy OAuth “f01” tokens. Due to a bug, this also ended up rejecting the token “bundles” used by flyctl - these bundles include one Macaroon token per org, as well as an user-specific OAuth token which uses the same “f01” prefix as the legacy tokens.

We rolled out an update to the token parsing/rejection logic to allow mixed-token bundles (while still rejecting legacy tokens), and flyctl behavior returned to normal; we also added a code test to help catch similar issues in the future.