rstillwell/deckhearth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(api): return 401 (not 500) on unauthenticated cards-collection writes #10

Merged
varutasu merged 1 commit from brief/fix-auth-bypass/6-cards-null-guard into main 2026-05-23 12:04:55 -04:00
Conversation 2 Commits 1 Files changed 1 +12
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit e391be92ad - Show all commits

12
pages/api/collections/[identifier]/cards.js
View file

@ -99,6 +99,10 @@ export default async function handler(req, res) {
res.status(200).json({ cards }); res.status(200).json({ cards });
} else if (req.method === 'POST') { } else if (req.method === 'POST') {
if (!user) {
return res.status(401).json({ error: 'Authentication required to modify this collection' });
}
// Add card to collection - only allow if user has write access // Add card to collection - only allow if user has write access
const canWrite = collection.user_id === user.userId || const canWrite = collection.user_id === user.userId ||
['owner', 'editor'].includes(collection.user_role); ['owner', 'editor'].includes(collection.user_role);
@ -160,6 +164,10 @@ export default async function handler(req, res) {
`; `;
} else if (req.method === 'PUT') { } else if (req.method === 'PUT') {
if (!user) {
return res.status(401).json({ error: 'Authentication required to modify this collection' });
}
// Update card quantity in collection // Update card quantity in collection
const canWrite = collection.user_id === user.userId || const canWrite = collection.user_id === user.userId ||
['owner', 'editor'].includes(collection.user_role); ['owner', 'editor'].includes(collection.user_role);
@ -209,6 +217,10 @@ export default async function handler(req, res) {
`; `;
} else if (req.method === 'DELETE') { } else if (req.method === 'DELETE') {
if (!user) {
return res.status(401).json({ error: 'Authentication required to modify this collection' });
}
// Remove card from collection // Remove card from collection
const canWrite = collection.user_id === user.userId || const canWrite = collection.user_id === user.userId ||
['owner', 'editor'].includes(collection.user_role); ['owner', 'editor'].includes(collection.user_role);