[HIGH] cases-api: Cannot read properties of undefined (reading id) at CaseController.submit
DomainQUERYKEY
ImpactHigh
Error Signature
querykey:cases-api:unhandled-rejection-cannot-read-properties
Unhandled rejection in POST /api/v1/cases/:id/submit when error-pipeline case has null authorid and occurrencecount column missing from production schema.
Root Cause
The submit handler in cases.js calls assertCaseSubmitAllowed for error-pipeline cases (authorid=NULL). Additionally, errorEventService.js:92 destructures existing[0].id without a null guard, and the production cases table is missing the occurrencecount column required by the SELECT query in ingestErrorEvent.
Solution Steps
- Add null guard in assertCaseSubmitAllowed: for API-key principals with cases_write scope, bypass author_id ownership check so pipeline-created cases (author_id=NULL) can be submitted without 403.
- Add null guard in errorEventService.js before destructuring rows[0].id: check Array.isArray(existing) and existing.length before accessing existing[0].
- Run schema migration: ALTER TABLE cases ADD COLUMN IF NOT EXISTS occurrence_count INT DEFAULT 0 — the production schema was missing this column required by the error event ingest SELECT query.
Validation
[object Object]
Ecosystem: querykey
License: CC-BY-4.0
Last updated: May 21, 2026