fix(web): Fix ask link generation for anonymous access

[brendan-kellam]

Fixes #871

Also improves error handling for /api/chat/blocking s.t., errors are actually propagated

Summary by CodeRabbit

• Bug Fixes
  • Resolved a security vulnerability where session links generated for code analysis operations were accessible to unauthenticated users.
  • Enhanced error handling in chat streaming to provide improved error recovery and reporting.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

This PR fixes an issue where unauthenticated chat sessions created via MCP would be marked as PRIVATE with no owner, resulting in 404 errors when accessed. The fix makes chat visibility conditional (PRIVATE when authenticated, PUBLIC otherwise) and refactors error handling in the chat streaming APIs.

Changes

Cohort / File(s)	Summary
Chat Session Visibility Fix packages/web/src/app/api/(server)/chat/blocking/route.ts	Made chat visibility conditional based on authentication: PRIVATE when a user is present, PUBLIC otherwise. Enhanced error handling in streaming path to convert non-ServiceError exceptions into ServiceErrorException with INTERNAL_SERVER_ERROR.
Error Handling Refactoring packages/web/src/app/api/(server)/chat/route.ts	Externalized error handling via new onError callback parameter in CreateMessageStreamResponseProps interface and createMessageStream function, replacing internal errorHandler logic with plumbed callback invocation.
Documentation CHANGELOG.md	Added Fixed entry documenting the resolution of session links being accessible to unauthenticated users in ask_codebase MCP calls.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• fix(ask_sb): Fix long generation times on first message in thread #447: Modifies the chat API streaming logic in packages/web/src/app/api/(server)/chat/route.ts, affecting the POST handler structure and message-stream invocation patterns similarly to this PR.

Suggested reviewers

• msukkari

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch bkellam/fix-SOU-439

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

---

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

---