chore: expose web app runner - #2
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting
| export async function requireAdmin() { | ||
| const user = await getSessionUser(); | ||
| if (!user) { | ||
| throw Object.assign(new Error('Unauthorized'), { status: 401 }); | ||
| } | ||
| if (user.role !== 'ADMIN') { | ||
| throw Object.assign(new Error('Forbidden'), { status: 403 }); | ||
| } |
There was a problem hiding this comment.
[P1] Return 401/403 instead of throwing in admin guard
requireAdmin throws generic Error objects with a status property, but the API routes that call it do not catch these errors. In Next.js route handlers an uncaught error always becomes a 500 response, so unauthorized or forbidden callers receive a 500 instead of the expected 401/403. This makes it impossible for clients (or automated tools) to distinguish authentication failures from server errors. Consider having requireAdmin return a NextResponse or handling the error in the route before returning.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
https://chatgpt.com/codex/tasks/task_e_68d8f1e3c290832aa3df8f56baffc2df