https://sonarly.com/issue/32310?type=bug
The REST middleware in `hydrateRestRequest` throws a plain `Error('No data sources found')` when the authenticated token lacks workspace context, resulting in a 500 Internal Server Error instead of a proper 401/403 auth error. This causes Sentry noise and returns misleading error messages to API consumers.
Fix: Replaced the two `throw new Error('No data sources found')` in `hydrateRestRequest` with `throw new AuthException(...)` using `AuthExceptionCode.FORBIDDEN_EXCEPTION`.
**Why this fixes the bug:**
The original plain `Error` had no `status` property and wasn't an `AuthException` instance, so `getStatus()` fell through to return 500. This caused:
1. A 500 Internal Server Error response to the client (misleading — implies server bug)
2. Sentry capture via `shouldCaptureException` which captures all 500s
The new `AuthException` with `FORBIDDEN_EXCEPTION` code is handled by the existing `getStatus()` method at line 148-149, which calls `getAuthExceptionRestStatus()` and returns 403. The `shouldCaptureException` utility skips errors with status < 500, eliminating Sentry noise.
**What changed:**
- Added `AuthExceptionCode` to the existing `AuthException` import
- Line 109: `throw new Error('No data sources found')` → `throw new AuthException('Workspace not found in auth context', AuthExceptionCode.FORBIDDEN_EXCEPTION)`
- Line 113: `throw new Error('No data sources found')` → `throw new AuthException('Workspace database schema is not configured', AuthExceptionCode.FORBIDDEN_EXCEPTION)`
The error messages are now descriptive and actionable — the first tells the client their token lacks workspace context, the second tells them the workspace isn't fully set up.
Sonarly Claude Code
0caefd274c