From 084848864d78012d801fba85b5827206d5eccac5 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Tue, 19 May 2026 00:15:48 +0300 Subject: Fix RevokeShare 500 on unknown token; add S14 rescan + S15 auth boundary scenarios MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug fix: shareService.RevokeShare returned errors.New("share not found") instead of the sentinel ErrShareNotFound, so handleError fell through to HTTP 500 instead of 404 for DELETE /api/v1/shares/{unknown-token}. The sister method ValidateShareToken already used the sentinel; this aligns them. Verified with curl: DELETE on a missing token now returns 404. The bug surfaced while drafting S15 (auth-boundary negative tests), which exercises 401 unauthenticated, 403 non-admin → admin routes, and 404 unknown resources. S14 covers admin rescan + scan-progress polling. All 15 LLM e2e scenarios pass against the fixed server. Co-Authored-By: Claude Opus 4.7 --- player-server/internal/service/share.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'player-server/internal/service') diff --git a/player-server/internal/service/share.go b/player-server/internal/service/share.go index 9552031..e218625 100644 --- a/player-server/internal/service/share.go +++ b/player-server/internal/service/share.go @@ -4,7 +4,6 @@ import ( "context" "crypto/rand" "encoding/hex" - "errors" "fmt" "path/filepath" "time" @@ -77,7 +76,9 @@ func (s *shareService) RevokeShare(ctx context.Context, token string, userID int return fmt.Errorf("get share: %w", err) } if share == nil { - return errors.New("share not found") + // Return the sentinel so handleError maps this to HTTP 404. + // Returning a plain errors.New here used to fall through to 500. + return ErrShareNotFound } _, err = s.helper.verifyAccess(ctx, share.MediaID, userID) -- cgit v1.2.3