PR Summary

Low Risk
Low risk: small change limited to error handling in a single endpoint, converting known auth/session failures from 500s to 401s.

Overview
Fixes POST /api/auth/socket-token to treat better-auth UNAUTHORIZED/401 errors (missing or expired session) as an authentication failure and return 401 { error: "Authentication required" } instead of falling through to a 500.

Adds a warning log for these cases while keeping existing 500 logging/response for unexpected token generation failures.

^{Reviewed by Cursor Bugbot for commit ff5c846. Bugbot is set up for automated code reviews on this repo. Configure here.}

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 8, 2026 10:59pm

Greptile Summary

This PR fixes a bug where better-auth's sessionMiddleware throws APIError(\"UNAUTHORIZED\") on missing/expired sessions, which was previously propagated as a 500 response. The catch block now inspects statusCode === 401 || status === 'UNAUTHORIZED' and returns a proper 401 to the client.

Confidence Score: 5/5

This PR is safe to merge — it is a focused, single-file bug fix with no regressions risk.

The change is minimal and narrowly scoped: a single catch-block addition that remaps a known better-auth UNAUTHORIZED error to 401. All logging standards are followed, no any types are introduced (only a type assertion, flagged as P2 style), and the fallthrough to 500 for unexpected errors is preserved correctly.

No files require special attention.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[POST /api/auth/socket-token] --> B{Auth disabled?}
    B -- Yes --> C[Return anonymous socket identifier]
    B -- No --> D[Call auth.api.generateOneTimeToken]
    D --> E{Success?}
    E -- Yes, response exists --> F[Return 200 with socket identifier]
    E -- No response value --> G[Return 401 Authentication required]
    D --> H{Error thrown?}
    H -- statusCode 401 or status UNAUTHORIZED --> I[logger.warn + Return 401]
    H -- Other error --> J[logger.error + Return 500]

_{Reviews (1): Last reviewed commit: "fix(error): catch socket auth error as 4..." | Re-trigger Greptile}