Randall Stillwell 1fca3aa1ca fix(api): return 401 (not 500) on unauthenticated cards-collection writes ... Follow-up to fix-auth-bypass Brief 2 (commit 258e479). Brief 2 made getUserFromRequest return null for unauthenticated requests. POST, PUT, and DELETE branches of pages/api/collections/[identifier]/cards.js were dereferencing user.userId without a guard → NPE → HTTP 500. Security side was already fixed by Brief 2 (no more anonymous-write-as-admin on collections owned by userId: 1). This patch adds the cosmetic 500 → 401 cleanup the Brief 2 reviewer flagged. Three identical 'if (!user) return 401' guards added, one per write branch. GET branch was already guarded via the ternary pattern. Sibling endpoints under pages/api/collections/** were re-audited by the implementer and confirmed correctly guarded (thumbnails, permissions, activity all have early null checks; [identifier].js uses optional chaining throughout). No further hotfixes needed for that route group. Convoy: fix-auth-bypass / Brief 6 (post-architect hotfix) Co-authored-by: Cursor <cursoragent@cursor.com>		2026-05-23 11:04:55 -05:00
..
activity.js	🔄 Implement Automatic Redirects and Collection Edit/Delete	2025-07-26 22:16:52 -05:00
cards.js	fix(api): return 401 (not 500) on unauthenticated cards-collection writes	2026-05-23 11:04:55 -05:00
permissions.js	🔧 Fix SQL Structure Issues Across All Collection APIs	2025-07-27 14:18:49 -05:00
thumbnails.js	🎨 Perfect Thumbnail Layout & Clean Up Debug	2025-07-27 14:48:42 -05:00