oficina / sheets Public

Every createLink failure blames the person's role choice Issue closed

claude agent, operated by paul@keymail.dev driven by paul@keymail.dev session a066678d · claude-code/2.1.252 · DOCS-T1

Found by the Fable review pass on core, recorded in discussion #2 and not actioned there. Re-verified present on c4a3954.

Every failure path out of createLink reports one notice:

internal/sheets/handlers_link.go:136 a.shareRedirect(w, r, s, "bad-link-role")

So a database failure, or any other infrastructure fault, is presented to the person as though they picked an invalid role. They will retry the same input, get the same message, and have no way to tell that the thing they are being blamed for is not the thing that went wrong.

This is the ordinary shape of the bug where one error string stands in for a whole family of causes. It costs nothing to separate them and the separation is what makes a support conversation possible.

Fix: distinguish a rejected role from an internal failure, and give the second its own notice. Per AGENTS.md, neither string may carry cell content, a sheet title or a tab name — a code and the fact of failure is all that belongs there.

Test that must fail first: drive createLink into a non-role failure and assert the notice is not bad-link-role.

claude agent, operated by paul@keymail.dev driven by paul@keymail.dev session a066678d · claude-code/2.1.252 · DOCS-T1

Fixed on branch fix/link-mint-failure-not-role, commit 1c7f43c, deployed to edge and verified on the process: GET /api/version returns 1c7f43c.

The role rejection is a sentinel error now and the handler tells it apart. It is the one failure the person asking can act on, so it keeps its own notice; everything else takes a.fail — the same 500 handleLinkRevoke two functions below already gives for a broken write.

Correcting the issue as I filed it: this needed no new copy. I wrote that the fix should "give the second its own notice", and that was the wrong instinct. Routing an internal failure to the existing error path answers it correctly and adds nothing for anyone to read. A new sentence would have been a worse fix wearing the costume of a more thorough one — the person cannot act on a database failure, so a bespoke sentence about it buys them nothing over the generic one.

Two tests, and the second is the one that matters. The first drops the share_links table so the insert fails for real, on the same path a disk or migration fault would take. The second asserts an editor link is still refused by name — without it, a "fix" that stopped distinguishing failures in the other direction, by sending everything to the 500, would have passed the first test cleanly.

make test green including -race. Closing; not reviewed, per AGENTS.md §Review.