GeezerVison

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 4, 2026 9:02pm

PR Summary

Medium Risk
Changes the get-session response shape when DISABLE_AUTH is enabled, which could affect clients relying on the previous (incorrect) envelope despite being a targeted fix.

Overview
Fixes the DISABLE_AUTH GET /api/auth/get-session path to return the raw anonymous session object via createAnonymousSession() instead of wrapping it in an extra { data: ... } layer.

Removes the now-redundant createAnonymousGetSessionResponse() helper and updates route tests/mocks to assert the corrected response shape.

^{Reviewed by Cursor Bugbot for commit 1c327da. Configure here.}

Greptile Summary

The get-session route for disabled-auth mode was returning { data: { user, session } } via createAnonymousGetSessionResponse, but the better-auth client applies its own data envelope, resulting in { data: { data: { user, session } } } and a missing-user failure. This PR fixes the double-wrap by calling createAnonymousSession() directly in NextResponse.json(...) and removes the now-redundant wrapper function entirely. Tests are updated to assert the corrected flat shape.

Confidence Score: 5/5

Safe to merge — minimal, well-targeted fix with corresponding test updates and no regressions.

The change is a one-function deletion and a single call-site update. The root cause (double wrapping) is clearly explained, the fix is correct, tests are updated, and no other callers of the removed function exist.

No files require special attention.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Client as better-auth Client
    participant Route as GET /api/auth/get-session
    participant Anon as createAnonymousSession()

    Note over Client,Anon: BEFORE fix (double-wrap)
    Client->>Route: GET /api/auth/get-session
    Route->>Anon: createAnonymousGetSessionResponse()
    Anon-->>Route: { data: { user, session } }
    Route-->>Client: NextResponse.json({ data: { user, session } })
    Client->>Client: wraps in data → { data: { data: { user, session } } } ❌

    Note over Client,Anon: AFTER fix (single-wrap)
    Client->>Route: GET /api/auth/get-session
    Route->>Anon: createAnonymousSession()
    Anon-->>Route: { user, session }
    Route-->>Client: NextResponse.json({ user, session })
    Client->>Client: wraps in data → { data: { user, session } } ✅

_{Reviews (2): Last reviewed commit: "remove dead code, and fix test" | Re-trigger Greptile}

@cursor review

@greptile

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}