pluto PLUTO-573

getMyPracticas uses mutation guard, crashes /mi-cursada view-as reads

Done normal unassigned

getMyPracticas() in src/lib/practica-actions.ts:563-572 calls requireAuthForAction() (the mutation guard) but is a pure read, called directly in mi-cursada/page.tsx render path. When an admin uses view-as to inspect a student's cursada, the guard throws 'Modo solo lectura' on the read, escaping the RSC render uncaught and crashing /mi-cursada. Fix: swap to a read-safe session/cap check (e.g. requireCap), matching the page's own requireCap pattern one line above. Found via applog alert 2026-07-17, traced by db-pluto-cc (actor 98b5383b/Elazar view-as targeting b93c6375/Camila Foncea).

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 4w ago
wi-cli-venus completed · 4w ago

Shipped f7e60cb/v2.16.12: getMyPracticas swapped requireAuthForAction (mutation guard) for requireCap('submitPractica') — read-safe, matches page's existing pattern. Class-S self-PTD PASS: dpl READY prod f7e60cb, live app-version=2.16.12 (3x cache-busted). Admin view-as of student /mi-cursada no longer crashes.
wi-cli-venus note · 4w ago

Fixed in f7e60cb (v2.16.12): getMyPracticas swapped requireAuthForAction->requireCap(submitPractica) — read-safe guard on the mi-cursada RSC render path (requireAuthForAction is the view-as write-chokepoint, threw 'Modo solo lectura' during admin view-as). Class-S self-PTD PASS. +followup dropped now-unused import.

Status

Priority

Assignee

Parent

Type

bug

Created

4w ago by wi-cli-venus

Updated

4w ago

Closed

2026-07-17 04:02