fix: three defensive bug fixes (DSN cache poisoning, region silent catches, projects silent catches) - #1433
Closed
cursor[bot] wants to merge 3 commits into
Closed
fix: three defensive bug fixes (DSN cache poisoning, region silent catches, projects silent catches)#1433cursor[bot] wants to merge 3 commits into
cursor[bot] wants to merge 3 commits into
Conversation
When setCachedDetection() is called with an empty allDsns array (no DSNs found during detection), it writes dsn="" and project_id="" into the dsn_cache table. getCachedDsn() previously returned these entries as valid cache hits, causing downstream code to receive a CachedDsnEntry with an empty DSN string. This wastes time on verification attempts and inflates cache hit telemetry with bogus entries. Guard getCachedDsn() to return undefined (cache miss) when the stored DSN is empty, so the caller falls through to a fresh detection scan. Co-authored-by: Miguel Betegón <miguelbetegongarcia@gmail.com>
The two catch blocks in resolveEffectiveOrg() silently swallowed errors from resolveOrgRegion() and listOrganizationsUncached(), making it impossible to diagnose why org resolution fell back to the raw slug. Network errors, auth issues, and API failures were completely invisible in debug output. Add log.debug() calls so errors are visible with --verbose, following the project's catch-block logging standard. Co-authored-by: Miguel Betegón <miguelbetegongarcia@gmail.com>
…rations Multiple catch blocks in api/projects.ts silently swallowed errors: - listProjects: cache population failures invisible - seedProjectCaches: project/DSN cache seeding failures invisible - findProjectByDsnKey: per-region lookup failures invisible - tryGetPrimaryDsn: DSN key fetch failures invisible All of these are best-effort operations that correctly fall back on error, but the silent catches made it impossible to diagnose why DSN detection, project resolution, or shell completions were not working. Add log.debug() calls so errors are visible with --verbose. Co-authored-by: Miguel Betegón <miguelbetegongarcia@gmail.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
3 tasks
betegon
added a commit
that referenced
this pull request
Sep 22, 2026
## Summary Swallowed best-effort failures (project cache writes, DSN key fan-out, `tryGetPrimaryDsn`) were either silent or only visible with `--verbose`. Users never pass that, so those errors never showed up as Sentry issues. Those catches now go through `reportCliError`: unexpected failures become issues, and network/auth/4xx still get silenced. Org-resolution fallbacks in `resolveEffectiveOrg` still only `log.debug`, because the command-boundary error is already reported. Also treats empty `dsn_cache` rows (`dsn=""` from a scan that found nothing) as misses on the single-DSN path, so `detectDsn()` doesn't verify a poisoned cache hit. Alternative to #1433, which only added debug logs. ## Test plan - [x] `pnpm exec vitest run test/lib/db/dsn-cache.test.ts test/lib/api/projects.test.ts test/lib/api-client.coverage.test.ts test/lib/api-client.multiregion.test.ts test/lib/resolve-effective-org.test.ts` - [ ] A 500 from `tryGetPrimaryDsn` shows up as a Sentry issue; a 404 does not - [ ] `detectDsn()` in a repo with no DSN does not treat an empty cache row as a hit Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com>
Member
|
fixed these things correctly on #1623 |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three independent bug fixes found via codebase analysis. Each addresses a different class of silent failure that made debugging CLI issues difficult.
Fix 1:
dsn-cache.ts— Empty DSN cache poisoningRoot cause: When
setCachedDetection()is called with an emptyallDsnsarray (no DSNs found), it storesdsn=""andproject_id=""in thedsn_cachetable.getCachedDsn()then returned these entries as valid cache hits.Reproduction: Run any CLI command in a project with no Sentry DSN configured. The empty row gets stored, then subsequent
detectDsn()calls waste time verifying a bogus cache entry before falling through to full scan.Fix: Guard
getCachedDsn()to returnundefinedwhendsnis empty.Fix 2:
region.ts— Silent catches inresolveEffectiveOrgRoot cause: Two catch blocks silently swallowed errors from
resolveOrgRegion()andlistOrganizationsUncached(), making org resolution failures invisible in debug output.Reproduction: Org resolution fails due to network error or auth issue — user sees the raw slug used as fallback with no explanation of why resolution failed.
Fix: Add
log.debug()calls so errors are visible with--verbose.Fix 3:
api/projects.ts— Silent catches in project operationsRoot cause: Multiple catch blocks in
listProjects,seedProjectCaches,findProjectByDsnKey, andtryGetPrimaryDsnsilently swallowed errors, making it impossible to diagnose why DSN detection, project resolution, or shell completions were not working.Reproduction: Any of these best-effort operations fail (e.g., cache write error, network timeout in region fan-out) — user gets no diagnostic output.
Fix: Add
log.debug()calls to all silent catch blocks.