GeezerVison

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 15, 2026 8:40am

PR Summary

Low Risk
Authorization and API error-mapping change with narrow scope; tests lock in the intended concealment behavior.

Overview
Fixes GET /api/credentials/[id] so workspace writers who are not credential members get a generic 403 { error: 'Forbidden' }, instead of exposing a credential-specific denial message.

Member-level authorization now raises a dedicated CredentialAccessRequiredError, and the credential detail route uses internalCredentialDetailErrorPolicy to map that error to the generic forbidden response. PUT/DELETE keep the existing error policy.

Regression tests cover the authorized use case (deny without membership) and the route handler response shape.

^{Reviewed by Cursor Bugbot for commit 4a72dcb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR restores a concealed forbidden response when workspace writers attempt to read credentials they cannot access.

• Introduces a credential-specific access-denial error.
• Maps that denial to a generic 403 response on the credential-detail route.
• Adds use-case and route-level regression coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

sequenceDiagram
  participant Writer as Workspace writer
  participant Route as GET /api/credentials/[id]
  participant UseCase as Credential read use case
  participant Policy as Detail error policy
  Writer->>Route: Request inaccessible credential
  Route->>UseCase: Execute credential read
  UseCase-->>Route: CredentialAccessRequiredError
  Route->>Policy: Project application error
  Policy-->>Writer: "403 {"error":"Forbidden"}"

_{Reviews (2): Last reviewed commit: "fix(credentials): conceal inaccessible c..." | Re-trigger Greptile}

@greptile

@cursor review