OUT-4013: stop raw ZodError on GET / from unauthenticated renders

[SandipBajracharya]

Changes

• authenticateHeaders no longer calls z.string().parse(undefined). When the proxy did not inject auth headers (invalid/expired token → withErrorHandler returns NextResponse.next() for non-API routes, so render proceeds unauthenticated), it now throws the existing domain errors AssemblyMissingHeadersError / AssemblyInvalidTokenError instead of a raw ZodError.
• The missing-header name is logged server-side via console.warn; the thrown error message stays generic so withErrorHandler can't leak the detail to API clients.
• onRequestError (instrumentation) now filters expected 401-class auth failures (AssemblyMissingHeadersError, AssemblyInvalidTokenError, AssemblyTokenParseError) instead of reporting them to Sentry as unhandled errors.
• global-error.tsx reverted to a plain Sentry.captureException + comment — server errors are redacted in prod, so type-based filtering there is a no-op.
• Unit tests added for both authenticateHeaders and onRequestError.

Fixes CLIENT-HOME-V3-1K (Sentry).

Testing Criteria

• pnpm typecheck, pnpm lint, pnpm test (48 passing), and pnpm build (no Edge Runtime warnings) all pass.
• authenticateHeaders unit tests: valid internal-user and client headers return the correct User; missing token/workspaceId throws AssemblyMissingHeadersError and the diagnostic names the missing header; missing both internalUserId and clientId throws AssemblyInvalidTokenError.
• onRequestError unit tests: expected auth errors are skipped (not sent to Sentry); a generic Error and a non-Error thrown value are still forwarded to Sentry.
• Loom: to add

Notes

• No dependencies on other PRs.
• The docs: commit (engineering notes in AGENTS.md) is unrelated to the fix and included only for convenience; can be dropped if preferred.

Impact & Surface Area of Change

• Touches the auth layer (authenticateHeaders) called by the root layout and ~10 API route controllers, plus the global instrumentation error hook. Happy-path behavior is unchanged (same User shape returned).
• The only behavior change for unauthenticated requests: a clean domain error + server log instead of an unhandled ZodError, and these expected 401-class failures no longer create Sentry noise. Worth a regression glance at authenticated page loads and API routes to confirm normal auth still works.

[linear-code]

OUT-4013

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
client-home-v3	Ready	Preview	Aug 6, 2026 8:37am

[greptile-apps]

Greptile Summary

This PR replaces raw missing-header validation failures with domain-specific authentication errors and narrows Sentry suppression to the expected missing-header case.

• Validates required proxy-injected headers before constructing the authenticated user.
• Logs missing-header diagnostics without exposing header names through thrown error messages.
• Suppresses only AssemblyMissingHeadersError in request instrumentation while forwarding other authentication and unexpected failures.
• Adds unit coverage for header authentication and request-error reporting behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/features/auth/lib/authenticate.ts	Replaces raw Zod failures for absent required headers with generic domain errors and server-side diagnostics while preserving the authenticated User shape.
src/instrumentation.ts	Narrows request-error suppression to AssemblyMissingHeadersError, resolving the previously reported loss of SDK-failure reporting.
src/app/global-error.tsx	Retains standard client-side Sentry capture and documents why server authentication filtering occurs in instrumentation.
tests/unit/authenticate-headers.test.ts	Covers missing required headers, invalid identity headers, diagnostics, and valid internal and client users.
tests/unit/on-request-error.test.ts	Confirms expected missing-header errors are suppressed while invalid-token, token-parse, generic, and non-Error values are forwarded.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Incoming request] --> B[Proxy authentication]
    B --> C[Root or API authentication]
    C --> D{Required headers present?}
    D -- No --> E[AssemblyMissingHeadersError]
    E --> F[Server warning]
    E --> G[onRequestError suppresses expected noise]
    D -- Yes --> H{User identity present?}
    H -- No --> I[AssemblyInvalidTokenError]
    I --> J[onRequestError forwards to Sentry]
    H -- Yes --> K[Authenticated User]

Loading

_{Reviews (2): Last reviewed commit: "fix(OUT-4013): only suppress AssemblyMis..." | Re-trigger Greptile}

[SandipBajracharya]

@greptileai review PR again

[priosshrsth]

lgtm