diff --git a/lib/puppet/network/rest_authconfig.rb b/lib/puppet/network/rest_authconfig.rb
index 7abe06956..1704ea0c1 100644
--- a/lib/puppet/network/rest_authconfig.rb
+++ b/lib/puppet/network/rest_authconfig.rb
@@ -1,96 +1,98 @@
 require 'puppet/network/authconfig'
 
 module Puppet
   class Network::RestAuthConfig < Network::AuthConfig
 
     extend MonitorMixin
     attr_accessor :rights
 
     DEFAULT_ACL = [
       { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
       # this one will allow all file access, and thus delegate
       # to fileserver.conf
       { :acl => "/file" },
       { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
       { :acl => "/report", :method => :save, :authenticated => true },
       { :acl => "/certificate/ca", :method => :find, :authenticated => false },
       { :acl => "/certificate/", :method => :find, :authenticated => false },
       { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
       { :acl => "/status", :method => [:find], :authenticated => true },
     ]
 
     def self.main
       synchronize do
         add_acl = @main.nil?
         super
         @main.insert_default_acl if add_acl and !@main.exists?
       end
       @main
     end
 
     # check wether this request is allowed in our ACL
     # raise an Puppet::Network::AuthorizedError if the request
     # is denied.
     def allowed?(request)
       read
 
       # we're splitting the request in part because
       # fail_on_deny could as well be called in the XMLRPC context
       # with a ClientRequest.
 
-            @rights.fail_on_deny(
-        build_uri(request),
-        
-                  :node => request.node,
-                  :ip => request.ip,
-                  :method => request.method,
-                  :environment => request.environment,
-                  :authenticated => request.authenticated)
+      if authorization_failure_exception = @rights.is_forbidden_and_why?(
+          build_uri(request),
+          :node => request.node,
+          :ip => request.ip,
+          :method => request.method,
+          :environment => request.environment,
+          :authenticated => request.authenticated)
+        Puppet.warning("Denying access: #{authorization_failure_exception}")
+        raise authorization_failure_exception
+      end
     end
 
     def initialize(file = nil, parsenow = true)
       super(file || Puppet[:rest_authconfig], parsenow)
 
       # if we didn't read a file (ie it doesn't exist)
       # make sure we can create some default rights
       @rights ||= Puppet::Network::Rights.new
     end
 
     def parse
       super()
       insert_default_acl
     end
 
     # force regular ACLs to be present
     def insert_default_acl
       DEFAULT_ACL.each do |acl|
         unless rights[acl[:acl]]
           Puppet.info "Inserting default '#{acl[:acl]}'(#{acl[:authenticated] ? "auth" : "non-auth"}) acl because #{( !exists? ? "#{Puppet[:rest_authconfig]} doesn't exist" : "none where found in '#{@file}'")}"
           mk_acl(acl)
         end
       end
       # queue an empty (ie deny all) right for every other path
       # actually this is not strictly necessary as the rights system
       # denies not explicitely allowed paths
       unless rights["/"]
         rights.newright("/")
         rights.restrict_authenticated("/", :any)
       end
     end
 
     def mk_acl(acl)
       @rights.newright(acl[:acl])
       @rights.allow(acl[:acl], acl[:allow] || "*")
 
       if method = acl[:method]
         method = [method] unless method.is_a?(Array)
         method.each { |m| @rights.restrict_method(acl[:acl], m) }
       end
       @rights.restrict_authenticated(acl[:acl], acl[:authenticated]) unless acl[:authenticated].nil?
     end
 
     def build_uri(request)
       "/#{request.indirection_name}/#{request.key}"
     end
   end
 end
diff --git a/lib/puppet/network/rights.rb b/lib/puppet/network/rights.rb
index e3cd3179a..b2146494c 100755
--- a/lib/puppet/network/rights.rb
+++ b/lib/puppet/network/rights.rb
@@ -1,267 +1,257 @@
 require 'puppet/network/authstore'
 require 'puppet/error'
 
 module Puppet::Network
 
 # this exception is thrown when a request is not authenticated
 class AuthorizationError < Puppet::Error; end
 
 # Define a set of rights and who has access to them.
 # There are two types of rights:
 #  * named rights (ie a common string)
 #  * path based rights (which are matched on a longest prefix basis)
 class Rights
 
   # We basically just proxy directly to our rights.  Each Right stores
   # its own auth abilities.
   [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |method|
     define_method(method) do |name, *args|
       if obj = self[name]
         obj.send(method, *args)
       else
         raise ArgumentError, "Unknown right '#{name}'"
       end
     end
   end
 
   # Check that name is allowed or not
   def allowed?(name, *args)
-    begin
-      fail_on_deny(name, :node => args[0], :ip => args[1])
-    rescue AuthorizationError
-      return false
-    rescue ArgumentError
-      # the namespace contract says we should raise this error
-      # if we didn't find the right acl
-      raise
-    end
-    true
+    !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
   end
 
-  def fail_on_deny(name, args = {})
+  def is_forbidden_and_why?(name, args = {})
     res = :nomatch
     right = @rights.find do |acl|
       found = false
       # an acl can return :dunno, which means "I'm not qualified to answer your question,
       # please ask someone else". This is used when for instance an acl matches, but not for the
       # current rest method, where we might think some other acl might be more specific.
       if match = acl.match?(name)
         args[:match] = match
         if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
           # return early if we're allowed
-          return if res
+          return nil if res
           # we matched, select this acl
           found = true
         end
       end
       found
     end
 
     # if we end here, then that means we either didn't match
     # or failed, in any case will throw an error to the outside world
     if name =~ /^\// or right
       # we're a patch ACL, let's fail
       msg = "#{(args[:node].nil? ? args[:ip] : "#{args[:node]}(#{args[:ip]})")} access to #{name} [#{args[:method]}]"
 
       msg += " authenticated " if args[:authenticated]
 
       error = AuthorizationError.new("Forbidden request: #{msg}")
       if right
         error.file = right.file
         error.line = right.line
       end
-      Puppet.warning("Denying access: #{error}")
     else
       # there were no rights allowing/denying name
       # if name is not a path, let's throw
-      error = ArgumentError.new "Unknown namespace right '#{name}'"
+      raise ArgumentError.new "Unknown namespace right '#{name}'"
     end
-    raise error
+    error
   end
 
   def initialize
     @rights = []
   end
 
   def [](name)
     @rights.find { |acl| acl == name }
   end
 
   def include?(name)
     @rights.include?(name)
   end
 
   def each
     @rights.each { |r| yield r.name,r }
   end
 
   # Define a new right to which access can be provided.
   def newright(name, line=nil, file=nil)
     add_right( Right.new(name, line, file) )
   end
 
   private
 
   def add_right(right)
     if right.acl_type == :name and include?(right.key)
       raise ArgumentError, "Right '%s' already exists"
     end
     @rights << right
     sort_rights
     right
   end
 
   def sort_rights
     @rights.sort!
   end
 
   # Retrieve a right by name.
   def right(name)
     self[name]
   end
 
   # A right.
   class Right < Puppet::Network::AuthStore
     include Puppet::FileCollection::Lookup
 
     attr_accessor :name, :key, :acl_type
     attr_accessor :methods, :environment, :authentication
 
     ALL = [:save, :destroy, :find, :search]
 
     Puppet::Util.logmethods(self, true)
 
     def initialize(name, line, file)
       @methods = []
       @environment = []
       @authentication = true # defaults to authenticated
       @name = name
       @line = line || 0
       @file = file
 
       case name
       when Symbol
         @acl_type = :name
         @key = name
       when /^\[(.+)\]$/
         @acl_type = :name
         @key = $1.intern if name.is_a?(String)
       when /^\//
         @acl_type = :regex
         @key = Regexp.new("^" + Regexp.escape(name))
         @methods = ALL
       when /^~/ # this is a regex
         @acl_type = :regex
         @name = name.gsub(/^~\s+/,'')
         @key = Regexp.new(@name)
         @methods = ALL
       else
         raise ArgumentError, "Unknown right type '#{name}'"
       end
       super()
     end
 
     def to_s
       "access[#{@name}]"
     end
 
     # There's no real check to do at this point
     def valid?
       true
     end
 
     def regex?
       acl_type == :regex
     end
 
     # does this right is allowed for this triplet?
     # if this right is too restrictive (ie we don't match this access method)
     # then return :dunno so that upper layers have a chance to try another right
     # tailored to the given method
     def allowed?(name, ip, args = {})
       return :dunno if acl_type == :regex and not @methods.include?(args[:method])
       return :dunno if acl_type == :regex and @environment.size > 0 and not @environment.include?(args[:environment])
       return :dunno if acl_type == :regex and not @authentication.nil? and args[:authenticated] != @authentication
 
       begin
         # make sure any capture are replaced if needed
         interpolate(args[:match]) if acl_type == :regex and args[:match]
         res = super(name,ip)
       ensure
         reset_interpolation if acl_type == :regex
       end
       res
     end
 
     # restrict this right to some method only
     def restrict_method(m)
       m = m.intern if m.is_a?(String)
 
       raise ArgumentError, "'#{m}' is not an allowed value for method directive" unless ALL.include?(m)
 
       # if we were allowing all methods, then starts from scratch
       if @methods === ALL
         @methods = []
       end
 
       raise ArgumentError, "'#{m}' is already in the '#{name}' ACL" if @methods.include?(m)
 
       @methods << m
     end
 
     def restrict_environment(env)
       env = Puppet::Node::Environment.new(env)
       raise ArgumentError, "'#{env}' is already in the '#{name}' ACL" if @environment.include?(env)
 
       @environment << env
     end
 
     def restrict_authenticated(authentication)
       case authentication
       when "yes", "on", "true", true
         authentication = true
       when "no", "off", "false", false
         authentication = false
       when "all","any", :all, :any
         authentication = nil
       else
         raise ArgumentError, "'#{name}' incorrect authenticated value: #{authentication}"
       end
       @authentication = authentication
     end
 
     def match?(key)
       # if we are a namespace compare directly
       return self.key == namespace_to_key(key) if acl_type == :name
 
       # otherwise match with the regex
       self.key.match(key)
     end
 
     def namespace_to_key(key)
       key = key.intern if key.is_a?(String)
       key
     end
 
     # this is where all the magic happens.
     # we're sorting the rights array with this scheme:
     #  * namespace rights are all in front
     #  * regex path rights are then all queued in file order
     def <=>(rhs)
       # move namespace rights at front
       return self.acl_type == :name ? -1 : 1 if self.acl_type != rhs.acl_type
 
       # sort by creation order (ie first match appearing in the file will win)
       # that is don't sort, in which case the sort algorithm will order in the
       # natural array order (ie the creation order)
       0
     end
 
     def ==(name)
       return(acl_type == :name ? self.key == namespace_to_key(name) : self.name == name.gsub(/^~\s+/,''))
     end
 
   end
 
 end
 end
diff --git a/spec/unit/network/rest_authconfig_spec.rb b/spec/unit/network/rest_authconfig_spec.rb
index 06436e723..9892c2b25 100755
--- a/spec/unit/network/rest_authconfig_spec.rb
+++ b/spec/unit/network/rest_authconfig_spec.rb
@@ -1,147 +1,147 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 require 'puppet/network/rest_authconfig'
 
 describe Puppet::Network::RestAuthConfig do
 
   DEFAULT_ACL = [
     { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
     # this one will allow all file access, and thus delegate
     # to fileserver.conf
     { :acl => "/file" },
     { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
     { :acl => "/report", :method => :save, :authenticated => true },
     { :acl => "/certificate/ca", :method => :find, :authenticated => false },
     { :acl => "/certificate/", :method => :find, :authenticated => false },
     { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
     { :acl => "/status", :method => [:find], :authenticated => true },
   ]
 
   before :each do
     FileTest.stubs(:exists?).returns(true)
     File.stubs(:stat).returns(stub('stat', :ctime => :now))
     Time.stubs(:now).returns :now
 
     @authconfig = Puppet::Network::RestAuthConfig.new("dummy", false)
     @authconfig.stubs(:read)
 
     @acl = stub_everything 'rights'
     @authconfig.rights = @acl
 
     @request = stub 'request', :indirection_name => "path", :key => "to/resource", :ip => "127.0.0.1",
       :node => "me", :method => :save, :environment => :env, :authenticated => true
   end
 
   it "should use the puppet default rest authorization file" do
     Puppet.expects(:[]).with(:rest_authconfig).returns("dummy")
 
     Puppet::Network::RestAuthConfig.new(nil, false)
   end
 
   it "should read the config file when needed" do
     @authconfig.expects(:read)
 
     @authconfig.allowed?(@request)
   end
 
   it "should ask for authorization to the ACL subsystem" do
-    @acl.expects(:fail_on_deny).with("/path/to/resource", :node => "me", :ip => "127.0.0.1", :method => :save, :environment => :env, :authenticated => true)
+    @acl.expects(:is_forbidden_and_why?).with("/path/to/resource", :node => "me", :ip => "127.0.0.1", :method => :save, :environment => :env, :authenticated => true).returns(nil)
 
     @authconfig.allowed?(@request)
   end
 
   describe "when defining an acl with mk_acl" do
     it "should create a new right for each default acl" do
       @acl.expects(:newright).with(:path)
       @authconfig.mk_acl(:acl => :path)
     end
 
     it "should allow everyone for each default right" do
       @acl.expects(:allow).with(:path, "*")
       @authconfig.mk_acl(:acl => :path)
     end
 
     it "should restrict the ACL to a method" do
       @acl.expects(:restrict_method).with(:path, :method)
       @authconfig.mk_acl(:acl => :path, :method => :method)
     end
 
     it "should restrict the ACL to a specific authentication state" do
       @acl.expects(:restrict_authenticated).with(:path, :authentication)
       @authconfig.mk_acl(:acl => :path, :authenticated => :authentication)
     end
   end
 
   describe "when parsing the configuration file" do
     it "should check for missing ACL after reading the authconfig file" do
       File.stubs(:open)
 
       @authconfig.expects(:insert_default_acl)
 
       @authconfig.parse
     end
   end
 
   DEFAULT_ACL.each do |acl|
     it "should insert #{acl[:acl]} if not present" do
       @authconfig.rights.stubs(:[]).returns(true)
       @authconfig.rights.stubs(:[]).with(acl[:acl]).returns(nil)
 
       @authconfig.expects(:mk_acl).with { |h| h[:acl] == acl[:acl] }
 
       @authconfig.insert_default_acl
     end
 
     it "should not insert #{acl[:acl]} if present" do
       @authconfig.rights.stubs(:[]).returns(true)
       @authconfig.rights.stubs(:[]).with(acl).returns(true)
 
       @authconfig.expects(:mk_acl).never
 
       @authconfig.insert_default_acl
     end
   end
 
   it "should create default ACL entries if no file have been read" do
     Puppet::Network::RestAuthConfig.any_instance.stubs(:exists?).returns(false)
 
     Puppet::Network::RestAuthConfig.any_instance.expects(:insert_default_acl)
 
     Puppet::Network::RestAuthConfig.main
   end
 
   describe "when adding default ACLs" do
 
     DEFAULT_ACL.each do |acl|
       it "should create a default right for #{acl[:acl]}" do
         @authconfig.stubs(:mk_acl)
         @authconfig.expects(:mk_acl).with(acl)
         @authconfig.insert_default_acl
       end
     end
 
     it "should log at info loglevel" do
       Puppet.expects(:info).at_least_once
       @authconfig.insert_default_acl
     end
 
     it "should create a last catch-all deny all rule" do
       @authconfig.stubs(:mk_acl)
       @acl.expects(:newright).with("/")
       @authconfig.insert_default_acl
     end
 
     it "should create a last catch-all deny all rule for any authenticated request state" do
       @authconfig.stubs(:mk_acl)
       @acl.stubs(:newright).with("/")
 
       @acl.expects(:restrict_authenticated).with("/", :any)
 
       @authconfig.insert_default_acl
     end
 
   end
 
 end
diff --git a/spec/unit/network/rights_spec.rb b/spec/unit/network/rights_spec.rb
index 969fc189e..ca3f22464 100755
--- a/spec/unit/network/rights_spec.rb
+++ b/spec/unit/network/rights_spec.rb
@@ -1,519 +1,519 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 require 'puppet/network/rights'
 
 describe Puppet::Network::Rights do
   before do
     @right = Puppet::Network::Rights.new
   end
 
   [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |m|
     it "should have a #{m} method" do
       @right.should respond_to(m)
     end
 
     describe "when using #{m}" do
       it "should delegate to the correct acl" do
         acl = stub 'acl'
         @right.stubs(:[]).returns(acl)
 
         acl.expects(m).with("me")
 
         @right.send(m, 'thisacl', "me")
       end
     end
   end
 
   it "should throw an error if type can't be determined" do
     lambda { @right.newright("name") }.should raise_error
   end
 
   describe "when creating new namespace ACLs" do
 
     it "should throw an error if the ACL already exists" do
       @right.newright("[name]")
 
       lambda { @right.newright("[name]") }.should raise_error
     end
 
     it "should create a new ACL with the correct name" do
       @right.newright("[name]")
 
       @right["name"].key.should == :name
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
       @right.newright("[name]")
 
       @right["name"].should be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
   describe "when creating new path ACLs" do
     it "should not throw an error if the ACL already exists" do
       @right.newright("/name")
 
       lambda { @right.newright("/name")}.should_not raise_error
     end
 
     it "should throw an error if the acl uri path is not absolute" do
       lambda { @right.newright("name")}.should raise_error
     end
 
     it "should create a new ACL with the correct path" do
       @right.newright("/name")
 
       @right["/name"].should_not be_nil
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
       @right.newright("/name")
 
       @right["/name"].should be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
   describe "when creating new regex ACLs" do
     it "should not throw an error if the ACL already exists" do
       @right.newright("~ .rb$")
 
       lambda { @right.newright("~ .rb$")}.should_not raise_error
     end
 
     it "should create a new ACL with the correct regex" do
       @right.newright("~ .rb$")
 
       @right.include?(".rb$").should_not be_nil
     end
 
     it "should be able to lookup the regex" do
       @right.newright("~ .rb$")
 
       @right[".rb$"].should_not be_nil
     end
 
     it "should be able to lookup the regex by its full name" do
       @right.newright("~ .rb$")
 
       @right["~ .rb$"].should_not be_nil
     end
 
     it "should create an ACL of type Puppet::Network::AuthStore" do
       @right.newright("~ .rb$").should be_a_kind_of(Puppet::Network::AuthStore)
     end
   end
 
   describe "when checking ACLs existence" do
     it "should return false if there are no matching rights" do
       @right.include?("name").should be_false
     end
 
     it "should return true if a namespace rights exist" do
       @right.newright("[name]")
 
       @right.include?("name").should be_true
     end
 
     it "should return false if no matching namespace rights exist" do
       @right.newright("[name]")
 
       @right.include?("notname").should be_false
     end
 
     it "should return true if a path right exists" do
       @right.newright("/name")
 
       @right.include?("/name").should be_true
     end
 
     it "should return false if no matching path rights exist" do
       @right.newright("/name")
 
       @right.include?("/differentname").should be_false
     end
 
     it "should return true if a regex right exists" do
       @right.newright("~ .rb$")
 
       @right.include?(".rb$").should be_true
     end
 
     it "should return false if no matching path rights exist" do
       @right.newright("~ .rb$")
 
       @right.include?(".pp$").should be_false
     end
   end
 
   describe "when checking if right is allowed" do
     before :each do
       @right.stubs(:right).returns(nil)
 
       @pathacl = stub 'pathacl', :acl_type => :regex, :"<=>" => 1, :line => 0, :file => 'dummy'
       Puppet::Network::Rights::Right.stubs(:new).returns(@pathacl)
     end
 
-    it "should delegate to fail_on_deny" do
-      @right.expects(:fail_on_deny).with("namespace", :node => "host.domain.com", :ip => "127.0.0.1")
+    it "should delegate to is_forbidden_and_why?" do
+      @right.expects(:is_forbidden_and_why?).with("namespace", :node => "host.domain.com", :ip => "127.0.0.1").returns(nil)
 
       @right.allowed?("namespace", "host.domain.com", "127.0.0.1")
     end
 
-    it "should return true if fail_on_deny doesn't fail" do
-      @right.stubs(:fail_on_deny)
+    it "should return true if is_forbidden_and_why? returns nil" do
+      @right.stubs(:is_forbidden_and_why?).returns(nil)
       @right.allowed?("namespace", :args).should be_true
     end
 
-    it "should return false if fail_on_deny raises an AuthorizationError" do
-      @right.stubs(:fail_on_deny).raises(Puppet::Network::AuthorizationError.new("forbidden"))
+    it "should return false if is_forbidden_and_why? returns an AuthorizationError" do
+      @right.stubs(:is_forbidden_and_why?).returns(Puppet::Network::AuthorizationError.new("forbidden"))
       @right.allowed?("namespace", :args1, :args2).should be_false
     end
 
     it "should first check namespace rights" do
       acl = stub 'acl', :acl_type => :name, :key => :namespace
       Puppet::Network::Rights::Right.stubs(:new).returns(acl)
 
       @right.newright("[namespace]")
       acl.expects(:match?).returns(true)
       acl.expects(:allowed?).with { |node,ip,h| node == "node" and ip == "ip" }.returns(true)
 
-      @right.fail_on_deny("namespace", { :node => "node", :ip => "ip" } )
+      @right.is_forbidden_and_why?("namespace", { :node => "node", :ip => "ip" } ).should == nil
     end
 
     it "should then check for path rights if no namespace match" do
       acl = stub 'nmacl', :acl_type => :name, :key => :namespace, :"<=>" => -1, :line => 0, :file => 'dummy'
       acl.stubs(:match?).returns(false)
       Puppet::Network::Rights::Right.stubs(:new).with("[namespace]").returns(acl)
 
       @right.newright("[namespace]")
       @right.newright("/path/to/there", 0, nil)
 
       @pathacl.stubs(:match?).returns(true)
 
       acl.expects(:allowed?).never
       @pathacl.expects(:allowed?).returns(true)
 
-      @right.fail_on_deny("/path/to/there", {})
+      @right.is_forbidden_and_why?("/path/to/there", {}).should == nil
     end
 
     it "should pass the match? return to allowed?" do
       @right.newright("/path/to/there")
 
       @pathacl.expects(:match?).returns(:match)
       @pathacl.expects(:allowed?).with { |node,ip,h| h[:match] == :match }.returns(true)
 
-      @right.fail_on_deny("/path/to/there", {})
+      @right.is_forbidden_and_why?("/path/to/there", {}).should == nil
     end
 
     describe "with namespace acls" do
-      it "should raise an error if this namespace right doesn't exist" do
-        lambda{ @right.fail_on_deny("namespace") }.should raise_error
+      it "should return an ArgumentError if this namespace right doesn't exist" do
+        lambda { @right.is_forbidden_and_why?("namespace") }.should raise_error(ArgumentError)
       end
     end
 
     describe "with path acls" do
       before :each do
         @long_acl = stub 'longpathacl', :name => "/path/to/there", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("/path/to/there", 0, nil).returns(@long_acl)
 
         @short_acl = stub 'shortpathacl', :name => "/path/to", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("/path/to", 0, nil).returns(@short_acl)
 
         @long_acl.stubs(:"<=>").with(@short_acl).returns(0)
         @short_acl.stubs(:"<=>").with(@long_acl).returns(0)
       end
 
       it "should select the first match" do
         @right.newright("/path/to/there", 0)
         @right.newright("/path/to", 0)
 
         @long_acl.stubs(:match?).returns(true)
         @short_acl.stubs(:match?).returns(true)
 
         @long_acl.expects(:allowed?).returns(true)
         @short_acl.expects(:allowed?).never
 
-        @right.fail_on_deny("/path/to/there/and/there", {})
+        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should select the first match that doesn't return :dunno" do
         @right.newright("/path/to/there", 0, nil)
         @right.newright("/path/to", 0, nil)
 
         @long_acl.stubs(:match?).returns(true)
         @short_acl.stubs(:match?).returns(true)
 
         @long_acl.expects(:allowed?).returns(:dunno)
         @short_acl.expects(:allowed?).returns(true)
 
-        @right.fail_on_deny("/path/to/there/and/there", {})
+        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should not select an ACL that doesn't match" do
         @right.newright("/path/to/there", 0)
         @right.newright("/path/to", 0)
 
         @long_acl.stubs(:match?).returns(false)
         @short_acl.stubs(:match?).returns(true)
 
         @long_acl.expects(:allowed?).never
         @short_acl.expects(:allowed?).returns(true)
 
-        @right.fail_on_deny("/path/to/there/and/there", {})
+        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should not raise an AuthorizationError if allowed" do
         @right.newright("/path/to/there", 0)
 
         @long_acl.stubs(:match?).returns(true)
         @long_acl.stubs(:allowed?).returns(true)
 
-        lambda { @right.fail_on_deny("/path/to/there/and/there", {}) }.should_not raise_error(Puppet::Network::AuthorizationError)
+        @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
 
       it "should raise an AuthorizationError if the match is denied" do
         @right.newright("/path/to/there", 0, nil)
 
         @long_acl.stubs(:match?).returns(true)
         @long_acl.stubs(:allowed?).returns(false)
 
-        lambda{ @right.fail_on_deny("/path/to/there", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+        @right.is_forbidden_and_why?("/path/to/there", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
 
       it "should raise an AuthorizationError if no path match" do
-        lambda { @right.fail_on_deny("/nomatch", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+        @right.is_forbidden_and_why?("/nomatch", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
     end
 
     describe "with regex acls" do
       before :each do
         @regex_acl1 = stub 'regex_acl1', :name => "/files/(.*)/myfile", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile", 0, nil).returns(@regex_acl1)
 
         @regex_acl2 = stub 'regex_acl2', :name => "/files/(.*)/myfile/", :acl_type => :regex, :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile/", 0, nil).returns(@regex_acl2)
 
         @regex_acl1.stubs(:"<=>").with(@regex_acl2).returns(0)
         @regex_acl2.stubs(:"<=>").with(@regex_acl1).returns(0)
       end
 
       it "should select the first match" do
         @right.newright("~ /files/(.*)/myfile", 0)
         @right.newright("~ /files/(.*)/myfile/", 0)
 
         @regex_acl1.stubs(:match?).returns(true)
         @regex_acl2.stubs(:match?).returns(true)
 
         @regex_acl1.expects(:allowed?).returns(true)
         @regex_acl2.expects(:allowed?).never
 
-        @right.fail_on_deny("/files/repository/myfile/other", {})
+        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should select the first match that doesn't return :dunno" do
         @right.newright("~ /files/(.*)/myfile", 0)
         @right.newright("~ /files/(.*)/myfile/", 0)
 
         @regex_acl1.stubs(:match?).returns(true)
         @regex_acl2.stubs(:match?).returns(true)
 
         @regex_acl1.expects(:allowed?).returns(:dunno)
         @regex_acl2.expects(:allowed?).returns(true)
 
-        @right.fail_on_deny("/files/repository/myfile/other", {})
+        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should not select an ACL that doesn't match" do
         @right.newright("~ /files/(.*)/myfile", 0)
         @right.newright("~ /files/(.*)/myfile/", 0)
 
         @regex_acl1.stubs(:match?).returns(false)
         @regex_acl2.stubs(:match?).returns(true)
 
         @regex_acl1.expects(:allowed?).never
         @regex_acl2.expects(:allowed?).returns(true)
 
-        @right.fail_on_deny("/files/repository/myfile/other", {})
+        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should not raise an AuthorizationError if allowed" do
         @right.newright("~ /files/(.*)/myfile", 0)
 
         @regex_acl1.stubs(:match?).returns(true)
         @regex_acl1.stubs(:allowed?).returns(true)
 
-        lambda { @right.fail_on_deny("/files/repository/myfile/other", {}) }.should_not raise_error(Puppet::Network::AuthorizationError)
+        @right.is_forbidden_and_why?("/files/repository/myfile/other", {}).should == nil
       end
 
       it "should raise an error if no regex acl match" do
-        lambda{ @right.fail_on_deny("/path", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+        @right.is_forbidden_and_why?("/path", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
 
       it "should raise an AuthorizedError on deny" do
-        lambda { @right.fail_on_deny("/path", {}) }.should raise_error(Puppet::Network::AuthorizationError)
+        @right.is_forbidden_and_why?("/path", {}).should be_instance_of(Puppet::Network::AuthorizationError)
       end
 
     end
   end
 
   describe Puppet::Network::Rights::Right do
     before :each do
       @acl = Puppet::Network::Rights::Right.new("/path",0, nil)
     end
 
     describe "with path" do
       it "should say it's a regex ACL" do
         @acl.acl_type.should == :regex
       end
 
       it "should match up to its path length" do
         @acl.match?("/path/that/works").should_not be_nil
       end
 
       it "should match up to its path length" do
         @acl.match?("/paththatalsoworks").should_not be_nil
       end
 
       it "should return nil if no match" do
         @acl.match?("/notpath").should be_nil
       end
     end
 
     describe "with regex" do
       before :each do
         @acl = Puppet::Network::Rights::Right.new("~ .rb$",0, nil)
       end
 
       it "should say it's a regex ACL" do
         @acl.acl_type.should == :regex
       end
 
       it "should match as a regex" do
         @acl.match?("this should work.rb").should_not be_nil
       end
 
       it "should return nil if no match" do
         @acl.match?("do not match").should be_nil
       end
     end
 
     it "should allow all rest methods by default" do
       @acl.methods.should == Puppet::Network::Rights::Right::ALL
     end
 
     it "should allow only authenticated request by default" do
       @acl.authentication.should be_true
     end
 
     it "should allow modification of the methods filters" do
       @acl.restrict_method(:save)
 
       @acl.methods.should == [:save]
     end
 
     it "should stack methods filters" do
       @acl.restrict_method(:save)
       @acl.restrict_method(:destroy)
 
       @acl.methods.should == [:save, :destroy]
     end
 
     it "should raise an error if the method is already filtered" do
       @acl.restrict_method(:save)
 
       lambda { @acl.restrict_method(:save) }.should raise_error
     end
 
     it "should allow setting an environment filters" do
       Puppet::Node::Environment.stubs(:new).with(:environment).returns(:env)
 
       @acl.restrict_environment(:environment)
 
       @acl.environment.should == [:env]
     end
 
     ["on", "yes", "true", true].each do |auth|
       it "should allow filtering on authenticated requests with '#{auth}'" do
         @acl.restrict_authenticated(auth)
 
         @acl.authentication.should be_true
       end
     end
 
     ["off", "no", "false", false].each do |auth|
       it "should allow filtering on unauthenticated requests with '#{auth}'" do
         @acl.restrict_authenticated(auth)
 
         @acl.authentication.should be_false
       end
     end
 
     ["all", "any", :all, :any].each do |auth|
       it "should not use request authenticated state filtering with '#{auth}'" do
         @acl.restrict_authenticated(auth)
 
         @acl.authentication.should be_nil
       end
     end
 
     describe "when checking right authorization" do
       it "should return :dunno if this right is not restricted to the given method" do
         @acl.restrict_method(:destroy)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save } ).should == :dunno
       end
 
       it "should return allow/deny if this right is restricted to the given method" do
         @acl.restrict_method(:save)
         @acl.allow("127.0.0.1")
 
         @acl.allowed?("me","127.0.0.1", { :method => :save }).should be_true
       end
 
       it "should return :dunno if this right is not restricted to the given environment" do
         Puppet::Node::Environment.stubs(:new).returns(:production)
 
         @acl.restrict_environment(:production)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :environment => :development }).should == :dunno
       end
 
       it "should return :dunno if this right is not restricted to the given request authentication state" do
         @acl.restrict_authenticated(true)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :authenticated => false }).should == :dunno
       end
 
       it "should return allow/deny if this right is restricted to the given request authentication state" do
         @acl.restrict_authenticated(false)
         @acl.allow("127.0.0.1")
 
         @acl.allowed?("me","127.0.0.1", { :authenticated => false }).should be_true
       end
 
       it "should interpolate allow/deny patterns with the given match" do
         @acl.expects(:interpolate).with(:match)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :match => :match, :authenticated => true })
       end
 
       it "should reset interpolation after the match" do
         @acl.expects(:reset_interpolation)
 
         @acl.allowed?("me","127.0.0.1", { :method => :save, :match => :match, :authenticated => true })
       end
 
       # mocha doesn't allow testing super...
       # it "should delegate to the AuthStore for the result" do
       #     @acl.method(:save)
       #
       #     @acl.expects(:allowed?).with("me","127.0.0.1")
       #
       #     @acl.allowed?("me","127.0.0.1", :save)
       # end
     end
   end
 
 end