From ce4e35a3d469548921978a55c26a180e5685b1b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9=20Stoifl?= Date: Sat, 22 Aug 2026 13:07:09 +0200 Subject: [PATCH] Fix missing `new` on PermissionError in access.can() The catch block in `access.can()` constructed `errs.PermissionError` without `new`. The error constructors in `backend/lib/error.js` are plain constructor functions that assign to `this` and return nothing, so calling one without `new` evaluates to `undefined`. The statement therefore did `throw undefined`, the express error handler in `backend/app.js` received undefined (and could not read `.status` or `.public` off it), and the request fell through to the catch-all 404 handler in `backend/routes/main.js`. Net effect: every authorization failure raised by `access.can(...)` was reported to clients as `404 Not Found` instead of `403 Forbidden`. Line 45 of the same file already used `new` correctly, which shows this was an oversight rather than deliberate resource-existence hiding. A grep over `backend/` confirms this was the only error constructor invoked without `new`. --- backend/lib/access.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/lib/access.js b/backend/lib/access.js index a4dec5c4d..1ecaf250c 100644 --- a/backend/lib/access.js +++ b/backend/lib/access.js @@ -271,7 +271,7 @@ export default function (tokenString) { err.permission = permission; err.permission_data = data; logger.error(permission, data, err.message); - throw errs.PermissionError("Permission Denied", err); + throw new errs.PermissionError("Permission Denied", err); } }, };