ExceptionMiddleware discards the QuickConnect 409 message, so the actionable text never ships #36

New Issue

2026-09-26T18:34:06+10:00

unkin-agent commented

2026-09-26 18:34:06 +10:00

Follow-up from #18 / PR #34. Tracking: #12.

Problem

A refused quick-connect claim throws ConflictException with actionable text — "Request is being authorized elsewhere, or an earlier attempt to authorize it did not complete. Start quick connect again for a new code." — which tells the user the one thing that resolves it.

QuickConnectController.cs:120-127 lets it fall through to the middleware, and ExceptionMiddleware.cs:95-97 replaces the body with "Error processing request." outside Development. The status is right (409); the text never reaches a client.

QuickConnectStatusCodeTests.Authorize_AfterAMintThatFailed_... asserts the message on the exception object, and its middleware harness (Environments.Production) asserts only the status — so the tested behaviour is not the shipped behaviour.

The 404 leg already does this correctly: NotFound("Unknown secret").

Proposal

Catch ConflictException in QuickConnectController.AuthorizeQuickConnect and return Conflict(ex.Message), mirroring how the 404 leg returns its message. Add the missing ProducesResponseType for 404 on AuthorizeQuickConnect while there — it is the documented way out of a burned claim.

Acceptance

A test driving the real middleware in a non-Development environment asserts the 409 response body carries the actionable text, not just the status code.
The 404 leg keeps its message.

Follow-up from #18 / PR #34. Tracking: #12. ## Problem A refused quick-connect claim throws `ConflictException` with actionable text — "Request is being authorized elsewhere, or an earlier attempt to authorize it did not complete. Start quick connect again for a new code." — which tells the user the one thing that resolves it. `QuickConnectController.cs:120-127` lets it fall through to the middleware, and `ExceptionMiddleware.cs:95-97` replaces the body with `"Error processing request."` outside Development. The status is right (409); the text never reaches a client. `QuickConnectStatusCodeTests.Authorize_AfterAMintThatFailed_...` asserts the message on the exception object, and its middleware harness (`Environments.Production`) asserts only the status — so the tested behaviour is not the shipped behaviour. The 404 leg already does this correctly: `NotFound("Unknown secret")`. ## Proposal Catch `ConflictException` in `QuickConnectController.AuthorizeQuickConnect` and return `Conflict(ex.Message)`, mirroring how the 404 leg returns its message. Add the missing `ProducesResponseType` for 404 on `AuthorizeQuickConnect` while there — it is the documented way out of a burned claim. ## Acceptance - A test driving the real middleware in a non-Development environment asserts the 409 response **body** carries the actionable text, not just the status code. - The 404 leg keeps its message.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/jellyfin-ha-src#36