Skip to content

Shared library and git token routes do not say the feature is disabled in their 404 #8855

Closed

Description

@andypalmi

Summary

When shared-library or gitIntegration is not enabled for a team, the routes reply 404 { code: "not_found", error: "Not Found" }, the same response as an unknown team, an unknown token, or (for the library) a non-member. API clients cannot tell a plan limitation from a missing resource.

Steps to reproduce

  1. Disable gitIntegration for a team (team or team type features). As an owner, GET or PUT /api/v1/teams/<teamId>/git/tokens. Both return 404 Not Found.
  2. Disable shared-library for a team. POST or GET /storage/library/<teamId>/x returns the same 404 as an unknown library id.
  3. PUT /api/v1/teams/<teamId>/git/tokens/<unknown> on a team that has the feature returns the identical body.

Expected

The same as other plan-gated routes: 404 not_found with a message naming the feature, such as Not Found - FlowFuse Tables is not enabled for this team (forge/ee/routes/tables/index.js:14) and the Team Broker equivalent. For the shared library, the message should only be given after the membership check, so a non-member still cannot tell whether the team exists.

Reference

forge/ee/routes/gitops/index.js:14-17 and forge/ee/routes/sharedLibrary/index.js:13,38 send the generic not-found reply. Others such as httpTokens also send a bare 404.

Metadata

Metadata

Assignees

Type

No type

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions