From 568115aa624a601457eec69aed952f5a82a1eec1 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Fri, 12 Jun 2026 14:55:09 +0000
Subject: [PATCH] docs(web/guides): fix auth-patterns format check and
 hasStrategy rationale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parenthesize the combined-strategy format check at line 343 so
`(request.format ?: "html") == "json"` evaluates correctly — CFML
parses the unparenthesized form as `request.format ?: ("html" == "json")`,
which crashes at runtime when request.format is set and always falls
through to the HTML branch otherwise.

Also corrects the hasStrategy rationale: registerStrategy() replaces any
existing entry with the same name in place, so duplicate registrations
cannot stack. The guard skips rebuilding the strategy object on warm reloads.

Fixes #3116

Co-authored-by: wheels-bot[bot] <wheels-bot[bot]@users.noreply.github.com>
Signed-off-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
---
 .../3116-auth-patterns-format-check-and-hasstrategy.fixed.md  | 1 +
 .../docs/v4-0-0/digging-deeper/authentication-patterns.mdx    | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/3116-auth-patterns-format-check-and-hasstrategy.fixed.md

diff --git a/changelog.d/3116-auth-patterns-format-check-and-hasstrategy.fixed.md b/changelog.d/3116-auth-patterns-format-check-and-hasstrategy.fixed.md
new file mode 100644
index 0000000000..28d12d4eb0
--- /dev/null
+++ b/changelog.d/3116-auth-patterns-format-check-and-hasstrategy.fixed.md
@@ -0,0 +1 @@
+- Fix authentication-patterns guide: parenthesize the combined-strategy format check so `(request.format ?: "html") == "json"` evaluates correctly; the unparenthesized form crashed at runtime when `request.format` was set. Also corrects the `hasStrategy` rationale — `registerStrategy()` replaces in place so duplicates cannot stack; the guard skips rebuilding the strategy object on warm reloads (#3116).
diff --git a/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx b/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx
index ac070fe0c0..03099baee7 100644
--- a/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx
+++ b/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx
@@ -61,7 +61,7 @@ local.di.map("sessionStrategy").to("wheels.auth.SessionStrategy").asSingleton();
 
 Both are singletons — one instance per app lifetime. The authenticator holds its strategy registry in instance state, so a singleton is the correct scope.
 
-Wire the session strategy into the authenticator on app init. A cold reload registers it once; the `hasStrategy` check keeps a second reload from stacking duplicates:
+Wire the session strategy into the authenticator on app init. `registerStrategy()` replaces any existing entry with the same name in place, so duplicate registrations cannot stack. The `hasStrategy` guard simply skips rebuilding the strategy object on warm reloads:
 
 ```cfm {test:compile} title="config/app.cfm or equivalent init hook"
 if (StructKeyExists(application, "wheelsdi") && application.wheelsdi.containsInstance("authenticator")) {
@@ -340,7 +340,7 @@ component extends="wheels.Controller" {
     private function authenticate() {
         var result = service("authenticator").authenticate(request);
         if (!result.success) {
-            if (request.format ?: "html" == "json") {
+            if ((request.format ?: "html") == "json") {
                 renderWith(data={error: result.error}, status=result.statusCode);
             } else {
                 flashInsert(error="Please log in first");