Serve the recordings page for closed cases instead of 404 #17

New Issue

2026-06-01T01:02:05+02:00

Brummel commented

2026-06-01 01:02:05 +02:00

Symptom

Following the "Aufnahmen anzeigen" link on a closed case opens what looks like an empty page in the web UI.

Verified mechanism: the recordings route returns HTTP 404 with the JSON body {"error":"Case not found"} rather than rendered HTML — see server/src/error.rs:36 (NotFound → StatusCode::NOT_FOUND) and server/src/error.rs:44 (body is Json({"error": ...})). The browser shows that bare 404/JSON, which reads as a blank/empty page.

Open cases are unaffected; only cases carrying the .closed marker hit this.

Root cause

Two independent defects combine:

Handler rejects closed cases unconditionally. handle_case_recordings (server/src/routes/user_web.rs:881) always resolves the case via locate_case_or_404, which calls locate_case (server/src/routes/user_web.rs:940). locate_case returns None when crate::paths::is_closed finds the .closed marker (server/src/paths.rs:58), producing the 404. The handler takes no Query parameter, so it has no way to opt into closed cases — unlike handle_case_page (server/src/routes/user_web.rs:753), which already branches on query.include_closed() and uses locate_closed_case_or_404 (server/src/routes/user_web.rs:980) when show_closed=1.
Template drops the show_closed flag. The "Aufnahmen anzeigen" link in server/templates/case_page.html:747 is /cases/{{ case_id }}/recordings with no query string. The case-list template already gets this right: server/templates/my_cases.html:142 appends ?show_closed=1 for closed cases ({% if case.is_closed %}?show_closed=1{% endif %}).

Because the case page is itself only reachable for a closed case via ?show_closed=1, the recordings link must carry the same flag forward — and the handler must honour it.

Acceptance

Following "Aufnahmen anzeigen" on a closed case renders the recordings list (the recordings still exist on disk under the case directory; closing does not move them).
A regression test covers the closed-case recordings route (request /cases/<id>/recordings?show_closed=1 for a case with a .closed marker → 200 with the recordings, not 404). Per repo policy a bug fix lands with a failing-then-green test; integration tests live in the server crate's tests/ directory, not in examples.
Open-case behaviour and the IDOR-rejection logging for non-existent cases remain unchanged.

## Symptom Following the "Aufnahmen anzeigen" link on a **closed** case opens what looks like an empty page in the web UI. Verified mechanism: the recordings route returns HTTP `404` with the JSON body `{"error":"Case not found"}` rather than rendered HTML — see `server/src/error.rs:36` (`NotFound` → `StatusCode::NOT_FOUND`) and `server/src/error.rs:44` (body is `Json({"error": ...})`). The browser shows that bare 404/JSON, which reads as a blank/empty page. Open cases are unaffected; only cases carrying the `.closed` marker hit this. ## Root cause Two independent defects combine: 1. **Handler rejects closed cases unconditionally.** `handle_case_recordings` (`server/src/routes/user_web.rs:881`) always resolves the case via `locate_case_or_404`, which calls `locate_case` (`server/src/routes/user_web.rs:940`). `locate_case` returns `None` when `crate::paths::is_closed` finds the `.closed` marker (`server/src/paths.rs:58`), producing the 404. The handler takes no `Query` parameter, so it has no way to opt into closed cases — unlike `handle_case_page` (`server/src/routes/user_web.rs:753`), which already branches on `query.include_closed()` and uses `locate_closed_case_or_404` (`server/src/routes/user_web.rs:980`) when `show_closed=1`. 2. **Template drops the `show_closed` flag.** The "Aufnahmen anzeigen" link in `server/templates/case_page.html:747` is `/cases/{{ case_id }}/recordings` with no query string. The case-list template already gets this right: `server/templates/my_cases.html:142` appends `?show_closed=1` for closed cases (`{% if case.is_closed %}?show_closed=1{% endif %}`). Because the case page is itself only reachable for a closed case via `?show_closed=1`, the recordings link must carry the same flag forward — and the handler must honour it. ## Acceptance - [ ] Following "Aufnahmen anzeigen" on a closed case renders the recordings list (the recordings still exist on disk under the case directory; closing does not move them). - [ ] A regression test covers the closed-case recordings route (request `/cases/<id>/recordings?show_closed=1` for a case with a `.closed` marker → 200 with the recordings, not 404). Per repo policy a bug fix lands with a failing-then-green test; integration tests live in the server crate's `tests/` directory, not in examples. - [ ] Open-case behaviour and the IDOR-rejection logging for non-existent cases remain unchanged.

Brummel added the bug label 2026-06-01 01:02:05 +02:00

Brummel referenced this issue from a commit

2026-06-01 01:56:37 +02:00

fix(web): serve closed-case recordings page instead of 404

Brummel closed this issue

2026-06-01 01:56:37 +02:00

Brummel referenced this issue from a commit

2026-06-01 01:56:37 +02:00

fix(web): make closed cases fully viewable (discovery-gate, not access-gate)

Sign in to join this conversation.