From 1c77ad2a9ed3b761230707c2f4b253d473105c2a Mon Sep 17 00:00:00 2001 From: Kirill Date: Sat, 25 Apr 2026 22:29:50 +0000 Subject: [PATCH] fix: add error logging to access control catch block Silent catch in checkUniqueItemExists swallows all DB errors, making access control issues impossible to debug in development. This adds a console.warn in non-production environments when findOne fails, while preserving the existing deny-on-error behavior. Found during a static analysis sweep of popular open source projects. --- packages/core/src/lib/core/access-control.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/core/src/lib/core/access-control.ts b/packages/core/src/lib/core/access-control.ts index 88a488123c8..79e4cdcb43f 100644 --- a/packages/core/src/lib/core/access-control.ts +++ b/packages/core/src/lib/core/access-control.ts @@ -428,7 +428,12 @@ export async function checkUniqueItemExists( try { const item = await context.db[foreignList.listKey].findOne({ where: uniqueInput }) if (item !== null) return uniqueWhere - } catch (err) {} + } catch (err) { + // Log access control errors for debugging — access will still be denied below + if (process.env.NODE_ENV !== 'production') { + console.warn(`[keystone] access-control: findOne failed for ${foreignList.listKey}:`, err) + } + } throw accessDeniedError(cannotForItem(operation, foreignList)) }