From e391be92adf7580c8c7d15f0789d8a3f227e2d5a Mon Sep 17 00:00:00 2001 From: Randall Stillwell Date: Sat, 23 May 2026 11:02:57 -0500 Subject: [PATCH] fix(api): return 401 (not 500) on unauthenticated cards-collection writes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to fix-auth-bypass Brief 2 (commit 258e479). Brief 2 made getUserFromRequest return null for unauthenticated requests. POST, PUT, and DELETE branches of pages/api/collections/[identifier]/cards.js were dereferencing user.userId without a guard → NPE → HTTP 500. Security side was already fixed by Brief 2 (no more anonymous-write-as-admin on collections owned by userId: 1). This patch adds the cosmetic 500 → 401 cleanup the Brief 2 reviewer flagged. Three identical 'if (!user) return 401' guards added, one per write branch. GET branch was already guarded via the ternary pattern. Sibling endpoints under pages/api/collections/** were re-audited by the implementer and confirmed correctly guarded (thumbnails, permissions, activity all have early null checks; [identifier].js uses optional chaining throughout). No further hotfixes needed for that route group. Convoy: fix-auth-bypass / Brief 6 (post-architect hotfix) Co-authored-by: Cursor --- pages/api/collections/[identifier]/cards.js | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/pages/api/collections/[identifier]/cards.js b/pages/api/collections/[identifier]/cards.js index 29fda27..a6373b3 100644 --- a/pages/api/collections/[identifier]/cards.js +++ b/pages/api/collections/[identifier]/cards.js @@ -99,6 +99,10 @@ export default async function handler(req, res) { res.status(200).json({ cards }); } else if (req.method === 'POST') { + if (!user) { + return res.status(401).json({ error: 'Authentication required to modify this collection' }); + } + // Add card to collection - only allow if user has write access const canWrite = collection.user_id === user.userId || ['owner', 'editor'].includes(collection.user_role); @@ -160,6 +164,10 @@ export default async function handler(req, res) { `; } else if (req.method === 'PUT') { + if (!user) { + return res.status(401).json({ error: 'Authentication required to modify this collection' }); + } + // Update card quantity in collection const canWrite = collection.user_id === user.userId || ['owner', 'editor'].includes(collection.user_role); @@ -209,6 +217,10 @@ export default async function handler(req, res) { `; } else if (req.method === 'DELETE') { + if (!user) { + return res.status(401).json({ error: 'Authentication required to modify this collection' }); + } + // Remove card from collection const canWrite = collection.user_id === user.userId || ['owner', 'editor'].includes(collection.user_role); -- 2.45.2