rstillwell/deckhearth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(api): return 401 (not 500) on unauthenticated cards-collection writes

Browse source 
Follow-up to fix-auth-bypass Brief 2 (commit 258e479). Brief 2 made
getUserFromRequest return null for unauthenticated requests. POST, PUT,
and DELETE branches of pages/api/collections/[identifier]/cards.js
were dereferencing user.userId without a guard → NPE → HTTP 500.

Security side was already fixed by Brief 2 (no more
anonymous-write-as-admin on collections owned by userId: 1). This patch
adds the cosmetic 500 → 401 cleanup the Brief 2 reviewer flagged.

Three identical 'if (!user) return 401' guards added, one per write
branch. GET branch was already guarded via the ternary pattern.

Sibling endpoints under pages/api/collections/** were re-audited by the
implementer and confirmed correctly guarded (thumbnails, permissions,
activity all have early null checks; [identifier].js uses optional
chaining throughout). No further hotfixes needed for that route group.

Convoy: fix-auth-bypass / Brief 6 (post-architect hotfix)
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Randall Stillwell 2026-05-23 11:02:57 -05:00
parent 297afca1ae
commit e391be92ad
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
pages/api/collections/[identifier]/cards.js
View file

@ -99,6 +99,10 @@ export default async function handler(req, res) {
res.status(200).json({ cards });
} else if (req.method === 'POST') {
if (!user) {
return res.status(401).json({ error: 'Authentication required to modify this collection' });
}
// Add card to collection - only allow if user has write access
const canWrite = collection.user_id === user.userId ||
['owner', 'editor'].includes(collection.user_role);
@ -160,6 +164,10 @@ export default async function handler(req, res) {
`;
} else if (req.method === 'PUT') {
if (!user) {
return res.status(401).json({ error: 'Authentication required to modify this collection' });
}
// Update card quantity in collection
const canWrite = collection.user_id === user.userId ||
['owner', 'editor'].includes(collection.user_role);
@ -209,6 +217,10 @@ export default async function handler(req, res) {
`;
} else if (req.method === 'DELETE') {
if (!user) {
return res.status(401).json({ error: 'Authentication required to modify this collection' });
}
// Remove card from collection
const canWrite = collection.user_id === user.userId ||
['owner', 'editor'].includes(collection.user_role);