[Bug]: submitting survey response results in error

[tbcsec]

Before you start

• This is not a security vulnerability (those go through private reporting, never a public issue).
• I searched existing issues and this isn't a duplicate.

What happened?

Submitting a survey response as a participant results in a survey response that says has Couldn't Submit as the title, and Failed to execute 'json' on 'Response': Unexpected end of JSON input

Despite this error indicating otherwise, survey responses still seem to be captured and in the correct format.

Steps to reproduce

1. Open an open survey as a participant
2. Submit a response
3. Observe the error in the bottom right corner.

Version / commit

8aa8145

How are you running it?

The public demo (demo.flagpost.io)

Browser (if it's a UI bug)

No response

Relevant logs / screenshots

[tbcsec]

CONFIRMED

Status-code mismatch between the survey-submit endpoint and the generic frontend response parser.

Backend — backend/routers/feedback.py:456 (submit_response, POST /api/competitions/{competition_id}/surveys/{survey_id}/responses):

return Response(status_code=status.HTTP_201_CREATED)

This is a bare Starlette Response with no content=, so the body is empty (b"") — status 201, not 204, and not a JSON body. It's the only HTTP_201_CREATED handler in the backend that doesn't return a Pydantic model; every other one gets a real JSON body via FastAPI serialization.

Frontend — frontend/src/lib/api.ts:191-195 (apiFetch, the shared transport used by all lib/api.ts calls):

if (!res.ok) {
    throw new ApiError(res.status, await extractError(res));
}
if (res.status === 204) return undefined as T;
return res.json() as Promise<T>;

Only 204 is special-cased. feedbackApi.submit (frontend/src/lib/api.ts:924-932) gets back a 201 with an empty body, so res.ok is true, the 204 branch is skipped, and res.json() is called on an empty response — throwing SyntaxError: Unexpected end of JSON input.

That rejection propagates through useSubmitResponse (frontend/src/lib/hooks/use-feedback.ts:144-151) into the onError handler in frontend/src/components/feedback/survey-response.tsx:58-65, which is exactly the "Couldn't Submit" toast reported, with that exact message.

"Responses still seem to be captured correctly" checks out too: the DB commit (feedback.py:445) and survey.submitted event emission (feedback.py:447) both happen before the empty Response is constructed and returned — only the client-side parse of the (intentionally bodyless) success response fails.

Introducing commit: both sides of the mismatch (feedback.py:456 and the res.status === 204 check in api.ts) trace to the same single squashed initial-import commit, 31e1e99 ("demo: live activity simulator + richer seed"), which added the whole tree at once — not a later regression. Neither file has been touched since.

Test gap: backend/tests/test_feedback.py:284-288/:320-328 only assert status_code == 201 and never call .json(), so the empty body isn't exercised there (it's httpx TestClient, not a browser fetch, so it wouldn't reproduce the SyntaxError anyway). No frontend test exists for apiFetch's status-code branching or use-feedback.ts/survey-response.tsx.

Not applying a fix per instructions — this is a repro-confirmation pass only.

---

Generated by Claude Code