Skip to content

fix: add error logging to access control catch block#9824

Open
gugli4ifenix-design wants to merge 1 commit intokeystonejs:mainfrom
gugli4ifenix-design:fix/access-control-error-logging
Open

fix: add error logging to access control catch block#9824
gugli4ifenix-design wants to merge 1 commit intokeystonejs:mainfrom
gugli4ifenix-design:fix/access-control-error-logging

Conversation

@gugli4ifenix-design
Copy link
Copy Markdown

Problem

checkUniqueItemExists in access-control.ts has an empty catch block (line 431) that silently swallows all errors from findOne:

try {
    const item = await context.db[foreignList.listKey].findOne({ where: uniqueInput })
    if (item !== null) return uniqueWhere
} catch (err) {} // <- all errors silently swallowed

If findOne fails for any reason (DB connection error, misconfiguration, schema mismatch), the error is invisible — making access control issues extremely hard to debug in development.

Fix

Add console.warn in non-production environments:

} catch (err) {
    if (process.env.NODE_ENV !== 'production') {
        console.warn(\`[keystone] access-control: findOne failed for ${foreignList.listKey}:\`, err)
    }
}
  • Behavior unchanged — access is still denied on error
  • Development visibility — errors are now logged for debugging
  • Production safe — no logging in production (opt-in only)

Found during a static analysis sweep of 97 popular open source projects.

Silent catch in checkUniqueItemExists swallows all DB errors,
making access control issues impossible to debug in development.

This adds a console.warn in non-production environments when
findOne fails, while preserving the existing deny-on-error behavior.

Found during a static analysis sweep of popular open source projects.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant