Code review / follow the request
A missing header.
A traceable fix.
The incoming request carried an explicit override. The Next.js proxy dropped it before forwarding the request.
I traced the loss to the outgoing header construction, wrote a focused patch, and checked both versions with the same tests.
Independent open-source review · OpenAO · September 2026
01 / Trigger
A flag disappears in transit.
A map update includes the override header, a session cookie and a configured server proxy token.
PUT /api/editor/maps/1
x-protected-map-override: true
The original proxy omits that header from the upstream request. An API using the explicit flag therefore never receives it. POST and DELETE share the same path.
02 / Locate
Two source locations explain it.
In handleEditorProxy, lines 66–74 construct outgoing headers from server-side credentials and Content-Type. Lines 84–92 pass those headers to fetch. The override is absent from that construction.
Inspect the pinned source, lines 66–92
Reviewed commit: 12b967c163f4eca01e80f758aeedc8b153bfc249
03 / Fix
Forward one header, in one route family.
10 inserted lines, including two blank lines
Insert before original line 76. The change applies to PUT, POST and DELETE under maps, with the API retaining its own interpretation and permission decisions.
const protectedMapOverride = request.headers.get("x-protected-map-override");
if (
path[0] === "maps" &&
(method === "PUT" || method === "POST" || method === "DELETE") &&
protectedMapOverride !== null
) {
headers.set("x-protected-map-override", protectedMapOverride);
}
The patch preserves the value returned by Headers.get, including TRUE, false and an empty value. It adds no case normalization or Boolean conversion. Missing headers stay absent.
04 / Verify
Evidence you can inspect.
- Execute the actual handlers
The same 18 checks run the original and patched exports. The harness removes TypeScript-only syntax and uses native Node Request and Headers.
- Check the surrounding behavior
Missing credentials still return 401/403. GET and other route families keep their behavior. Body bytes, query parameters and response data remain intact.
- Make the result reproducible
A pinned source, file hashes, minimal patch, runnable harness and JSON results connect the finding to the observed test outcomes.
Download the review · Original test results · Patched test results
Test scope: Handler-level transport checks with stubbed Next dependencies, environment values and fetch. The run uses no network, database or real accounts. Full HTTP integration and backend authorization are separate checks.
Case context: An independent open-source sample, not commissioned client work or a RAG implementation. The patch is local and unmerged upstream.
Put this approach to work
Get a clear answer about one code flow.
A focused review with source-line references, reproduction evidence and targeted fix recommendations. Send the relevant source and the behavior you want checked.
$5 · One agreed code flow
Two-day delivery after scope and source are ready. Includes one clarification round.
Share the flow, expected behavior and relevant repository or files.