Skip to content

[Bugfix] Wrong error code in DeviceTelemetryRestController auth guard #3

@EnduranceCode

Description

@EnduranceCode

Description

In DeviceTelemetryRestController.save(), when the security authentication context is null, not authenticated, or the principal name is blank, the controller throws an EnduranceTrioException with EnduranceTrioError.NOT_FOUND (HTTP 404).

A missing or invalid authentication context should result in HTTP 401 (Unauthorized) or HTTP 403 (Forbidden), not HTTP 404 (Not Found). The NOT_FOUND response code is semantically incorrect for an authentication failure.

File affected:

  • endurancetrio-app/src/main/java/com/endurancetrio/app/tracker/api/DeviceTelemetryRestController.java
    (lines 99–108)

Acceptance Criteria

  • The two authentication guard blocks use EnduranceTrioError.UNAUTHORIZED (or equivalent)
    instead of EnduranceTrioError.NOT_FOUND
  • If EnduranceTrioError.UNAUTHORIZED does not exist in the EnduranceTrioError enum,
    it is added with the appropriate HTTP 401 mapping
  • The error message reflects the security context failure (e.g. "Authentication required")
  • The project builds and tests pass without errors

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecuritySecurity-related issues

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions