From 898070077359a3f52e7ae7ea9f1dd6138667bd4e Mon Sep 17 00:00:00 2001
From: Stefan Ekerfelt <stefan@encore.dev>
Date: Wed, 12 Nov 2025 15:17:38 +0100
Subject: [PATCH] runtime.ts: Fail requests with invalid x-encore-auth headers

---
 runtimes/core/src/api/endpoint.rs |  7 +------
 runtimes/core/src/api/error.rs    | 12 ++++++++++++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/runtimes/core/src/api/endpoint.rs b/runtimes/core/src/api/endpoint.rs
index 83f8697f03..bc69175ebb 100644
--- a/runtimes/core/src/api/endpoint.rs
+++ b/runtimes/core/src/api/endpoint.rs
@@ -467,12 +467,7 @@ impl EndpointHandler {
             .into_parts();
 
         // Authenticate the request from the platform, if applicable.
-        #[allow(clippy::manual_unwrap_or_default)]
-        let platform_seal_of_approval = match self.authenticate_platform(&parts) {
-            Ok(seal) => seal,
-            Err(_err) => None,
-        };
-
+        let platform_seal_of_approval = self.authenticate_platform(&parts)?;
         let meta = CallMeta::parse_with_caller(
             &self.shared.inbound_svc_auth,
             &parts.headers,
diff --git a/runtimes/core/src/api/error.rs b/runtimes/core/src/api/error.rs
index 0280c91e36..5b3a647e6b 100644
--- a/runtimes/core/src/api/error.rs
+++ b/runtimes/core/src/api/error.rs
@@ -150,6 +150,18 @@ impl From<WebSocketUpgradeRejection> for Error {
     }
 }
 
+impl From<crate::api::reqauth::platform::ValidationError> for Error {
+    fn from(value: crate::api::reqauth::platform::ValidationError) -> Self {
+        Error {
+            code: ErrCode::Unauthenticated,
+            message: "platform authentication failed".into(),
+            internal_message: Some(value.to_string()),
+            stack: None,
+            details: None,
+        }
+    }
+}
+
 impl From<Error> for AppError {
     fn from(val: Error) -> Self {
         let message = match val.internal_message {