Repository navigation
fix(public): show the message of the Public API's 401 - #1073
Merged
Merged
Conversation
Topherhindman
force-pushed
the
fix/lk-public-api-401-message
branch
from
October 23, 2026 17:11
938dc99 to
5ff3b7b
Compare
Topherhindman
force-pushed
the
auth-tests/lk-auth-scripts
branch
2 times, most recently
from
October 23, 2026 17:53
7d625e4 to
e07a424
Compare
Topherhindman
force-pushed
the
fix/lk-public-api-401-message
branch
from
October 23, 2026 17:53
5ff3b7b to
0a54d64
Compare
The Public API's auth middleware answers 401 with
{"error":{"code","message"}}, and its panic recovery answers 500 the
same way, unlike the top-level message of the errors its handlers
return. responseError only read the top level, so an expired or revoked
session printed the raw JSON before the sign-in hint. It now reads the
nested message too, so a server panic also shows "internal server
error" instead of the raw body.
Topherhindman
force-pushed
the
fix/lk-public-api-401-message
branch
from
October 23, 2026 19:39
0a54d64 to
ec7316b
Compare
JackNDwyer
approved these changes
Oct 23, 2026
u9g
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Public API's auth middleware answers 401 with
{"error":{"code","message"}}, and its panic recovery answers 500 the same way, unlike the top-levelmessageof the errors its handlers return.responseErroronly read the top level, so an expired or revoked session printed the raw JSON before the sign-in hint. It now reads the nested message too, so a server panic also showsinternal server errorinstead of the raw body.A top-level message still wins when both are present. An
"error"that isn't an object, or has no message, doesn't hide the top-level message or the raw body.Testing:
TestResponseErrorgains cases for the nested body, both levels set, a nested error without a message, and a non-object"error".rejected-session.txtardrops its known-bug skip and passes in full.