fix: tighten up error visibility handling #14606
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AlessioGr
requested review from
JarrodMFlesch and
jacobsfletch
as code owners
AlessioGr
commented
Nov 13, 2025
| return ( | ||
| <tr | ||
| className={`row-${rowIndex + 1}`} | ||
| data-id={row.id} |
Member
Author
There was a problem hiding this comment.
Just adding data-id for simpler e2e testing. Rest is identical
AlessioGr
commented
Nov 13, 2025
| hooks: { | ||
| beforeDelete: [ | ||
| ({ id }) => { | ||
| throw new APIError(`Test error: cannot delete document with ID ${id}`, 401) |
Member
Author
There was a problem hiding this comment.
This error will be shown
AlessioGr
commented
Nov 13, 2025
| hooks: { | ||
| beforeDelete: [ | ||
| ({ id }) => { | ||
| throw new Error(`Test error: cannot delete document with ID ${id}`) |
Member
Author
There was a problem hiding this comment.
This error will not be shown
Contributor
📦 esbuild Bundle Analysis for payloadThis analysis was generated by esbuild-bundle-analyzer. 🤖
Largest pathsThese visualization shows top 20 largest paths in the bundle.Meta file: packages/next/meta_index.json, Out file: esbuild/index.js
Meta file: packages/payload/meta_index.json, Out file: esbuild/index.js
Meta file: packages/payload/meta_shared.json, Out file: esbuild/exports/shared.js
Meta file: packages/richtext-lexical/meta_client.json, Out file: esbuild/exports/client_optimized/index.js
Meta file: packages/ui/meta_client.json, Out file: esbuild/exports/client_optimized/index.js
Meta file: packages/ui/meta_shared.json, Out file: esbuild/exports/shared_optimized/index.js
DetailsNext to the size is how much the size has increased or decreased compared with the base branch of this PR.
|
jessrynkar
approved these changes
Nov 14, 2025
Contributor
|
🚀 This is included in version v3.65.0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #14377
Non-public errors were returned from delete and update endpoints
Previously, non-public errors (
500errors, or errors withoutisPublic: trueandstatus) were returned from the delete and update endpoint. For security reason, this PR excludes the error messages from the response.This aligns bulk endpoints with others (e.g., deleteByID) that already gate error details through
routeError.ts.Loosen up isPublic check when throwing API error
APIErrornow infersisPublicfrom the status code unless explicitly provided:isPublicdefaults totrue.isPublicdefaults tofalse.You can still override by passing a boolean
isPublicexplicitly. Previously, the only way to mark the error as public was:throw new APIError('error message', 401, null ,false)which feels unnecessary explicit.
Now, you can do this:
throw new APIError('error message', 401)which previously resulted in
isPublic: falseand now results inisPublic: true.Stricter error check in routeError
routeErrornow usesisErrorPublic(err, config)to decide whether to expose the error message. Compared to the old condition (!config.debug && !err.isPublic && status === 500), this is a bit stricter and easier to understand. Errors withisPublic === falseare now hidden even for non-500 statuses (previously they were shown).