- Shipped
- September 5, 2026 at 8:00 PM UTC
- Author
- Kamo
- Commit
- a11156f
Two reads and nine response bodies, both halves of the same report. SessionRefreshController loaded the member one statement before the rights read that was fixed yesterday, and that load carried nothing. This endpoint is polled by every signed-in client on a short interval, so it is the first thing a catalog bump touches. Retried at the call rather than on refresh(), because the method goes on to write refreshed rights into the session and that is not work to repeat. **************** is a pure read behind the Interaction Center's directory; it takes the annotation directly. The rest is the response bodies. login() was fixed in 24ee442; the same pattern stood in nine more places on this controller — validate-otk, refresh-token, logout, user-info, csrf-token, validate-csrf, providers, session/info and session/extend — each catching Exception and putting e.getMessage() in the JSON. That is how a database error became a schema dump on the sign-in screen, and every one of these is reachable with no session or an expired one. They now answer with a fixed sentence and log the exception; three of them were not logging it at all, so the detail is now recorded where it was previously only shown to the user. Deliberately untouched: the two sites that catch IllegalArgumentException and answer 400. Those messages are written for the person reading them, which is the opposite of the ones above.