Randall Stillwell e391be92ad fix(api): return 401 (not 500) on unauthenticated cards-collection writes ... Follow-up to fix-auth-bypass Brief 2 (commit 258e479). Brief 2 made getUserFromRequest return null for unauthenticated requests. POST, PUT, and DELETE branches of pages/api/collections/[identifier]/cards.js were dereferencing user.userId without a guard → NPE → HTTP 500. Security side was already fixed by Brief 2 (no more anonymous-write-as-admin on collections owned by userId: 1). This patch adds the cosmetic 500 → 401 cleanup the Brief 2 reviewer flagged. Three identical 'if (!user) return 401' guards added, one per write branch. GET branch was already guarded via the ternary pattern. Sibling endpoints under pages/api/collections/** were re-audited by the implementer and confirmed correctly guarded (thumbnails, permissions, activity all have early null checks; [identifier].js uses optional chaining throughout). No further hotfixes needed for that route group. Convoy: fix-auth-bypass / Brief 6 (post-architect hotfix) Co-authored-by: Cursor <cursoragent@cursor.com>		2026-05-23 11:02:57 -05:00
..
[identifier]	fix(api): return 401 (not 500) on unauthenticated cards-collection writes	2026-05-23 11:02:57 -05:00
[identifier].js	✨ Major Scanner Improvements	2025-07-29 14:19:48 -05:00