1 Commits

Include renames

Author	SHA1	Message	Date
Hermes	a2e2a12eb8	fix(routes): convert alias-import + canonical-shape callsites to canonical errorResponse (DC-063) [glm-grade=A] ... Background (DC-062, 2026-08-18, c01a011): errorResponse has TWO bindings in src/utils/responses.js: - canonical: errorResponse(res, statusCode, message, extras) + DC-062 validator - alias: error(res, message, statusCode = 500) -- NO validator DC-062 already fixed routes/caddy-upstreams.js and added a defensive TypeError-throwing validator on the canonical path. DC-063 (this commit): the same bug class lurks in 2 more route files that import the alias 'error: errorResponse' but call it with the canonical shape '(res, NUM, STRING)'. The alias function does NOT run the validator, so at runtime the alias path silently fires res.status('event not found') -> TypeError -> 500 HTML panic silently masking the intended 4xx JSON response for the client. Affected files: - routes/security.js: 15 callsites (lines 110-251) Pre-fix every GET /events/:id (404), POST /events (400/409), PUT /events/batch (400/413), POST/PATCH/DELETE /hosts (400/404/409) all returned 500 HTML with a RangeError stack instead of the intended JSON. Fix: switched import to canonical so the existing canonical-shape callsites bind to the validator-armed function. 0 callsite changes. - routes/services.js: 7 callsites total 3 already in canonical shape (POST /services credentials, lines 222/246/261) -- switched import fixes them. 4 alias-shape callsites (lines 406/432/455/486) -- rewritten to canonical shape per responses.js:76. Test sweep: - NEW __tests__/routes/errorresponse-arg-order.regression.test.js (284 lines, 75 tests): pins (1) the validator (defense-in-depth) — 14 tests (2) the routes/ + src/utilities/ convention — 49 one-per-file static-tree walk that classifies each file's import style (alias vs canonical) and asserts each callsite matches the file's own convention. (3) live-HTTP smoke — security.js /events/:id + /hosts/:id return 404 JSON, never 500 HTML. Also serves as the spec defining the alias-vs-canonical convention for any future contributor. - UPDATED __tests__/routes/services.routes.test.js: fixture mock for src/utils/responses now exposes both errorResponse (canonical) and error (alias) so the route's canonical-shape import resolves. 29/29 tests still pass. Verification: full suite 93/93 / 2114/2114 green; security.js + services.js both fully canonical; 13 canonical-import files (DC-062 + DC-063) + 10 alias-import files (using message-first shape correctly) — proven consistent by the static sweep. GLM-5.3 stand-in judge round 1: GRADE=A (verified cold diff + convention check + 4-tool-call budget); 2 LOW polish suggestions logged for a follow-up DC: (a) require.cache injection in the live HTTP smoke should migrate to jest.mock(virtual:true) so a module rename fails loudly; (b) static sweep should assert a min-callsite floor per convention class.	2026-08-18 11:06:34 -07:00