fix: return 401 in getAllPermissions when user is not authenticated

[octo-patch]

Fixes #6105

Problem

GET /api/v1/auth/resolve returns a 500 Internal Server Error with message:

Cannot read properties of undefined (reading 'isOrganizationAdmin')

Root cause: /api/v1/auth/resolve is added to the whitelist (unauthenticated passthrough), intended for the POST /api/v1/auth/resolve handler. However, a GET request to the same path also bypasses authentication and matches the GET /api/v1/auth/:type route with type='resolve'. This calls getAllPermissions() where req.user is undefined, leading to the crash at:

if (type !== 'ROLE' && user.isOrganizationAdmin === false) {

This causes the login page to fail when the UI or tooling makes an unauthenticated GET to this endpoint.

Solution

Add an early null check in getAllPermissions to return 401 Unauthorized if req.user is not set, instead of crashing with a 500.

if (!user) {
    return res.status(StatusCodes.UNAUTHORIZED).json({ message: 'Unauthorized' })
}

This is a minimal defensive fix that makes the endpoint robust against unauthenticated requests regardless of how they reach the handler.

Testing

• Fresh install of Flowise 3.x: GET /api/v1/auth/resolve now returns 401 instead of 500
• Authenticated users calling GET /api/v1/auth/:type are unaffected
• POST /api/v1/auth/resolve (used by the UI) is unaffected

[gemini-code-assist]

Code Review

This pull request introduces an authentication check in the getAllPermissions controller to return a 401 Unauthorized status if the user is not logged in. Feedback suggests reordering the logic to perform this check before serializing permissions and using loose equality (== null) for the nullish check to align with standard idioms.

[gemini-code-assist]

Moving the authentication check before the permissions serialization avoids unnecessary processing for unauthenticated requests. This is particularly beneficial for endpoints that might be exposed to unauthenticated traffic. Additionally, using loose equality (== null) is the standard idiom for nullish checks in this project as per the general rules.

        const user = req.user as LoggedInUser
        if (user == null) {
            return res.status(StatusCodes.UNAUTHORIZED).json({ message: 'Unauthorized' })
        }
        const allPermissions = appServer.identityManager.getPermissions().toJSON()

References

1. In JavaScript/TypeScript, use loose equality (== null) as a standard idiom for a 'nullish' check that covers both null and undefined.