POST /project/:id/copy-with-customizations returns 500

[thehabes]

Bug Report

Severity: Major
Found during: Pre-production stack test (2026-03-26)
Endpoint: POST /project/:projectId/copy-with-customizations

Description

Copying a project with customizations crashes with a 500 error. The server attempts to .push() on an undefined array during the copy process.

Steps to Reproduce

curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"modules":{"annotations":true,"metadata":true}}' \
  "https://dev.api.t-pen.org/project/<PROJECT_ID>/copy-with-customizations"

Also tried with different body shapes:

• {"includeAnnotations":true,"includeMetadata":true} → 400 "modules must be an object"
• {"modules":{"annotations":true,"metadata":true,"layers":true,"tools":true,"roles":true,"group":false}} → 500

Expected

201 with a new project containing the selected modules.

Actual

{"status":500,"message":"Cannot read properties of undefined (reading 'push')"}

Analysis

The endpoint in projectCopyRouter.js correctly validates that modules is an object (returns 400 otherwise), but crashes during the actual copy processing. An array that should be initialized before items are pushed into it is undefined.

The other three copy variants all work correctly:

• POST /copy → 201 ✓
• POST /copy-without-annotations → 201 ✓
• POST /copy-with-group → 201 ✓

Impact

The Interfaces copy-with-customization component cannot create customized project copies.

Environment

• Stack: dev.api.t-pen.org
• Source project had: 1 layer, 2 pages, lines, custom metadata, columns
• Auth: valid Auth0 JWT

[thehabes]

Investigation Update

The endpoint works correctly when called the way Interfaces actually calls it. The 500 only occurs with an unexpected body shape.

Root cause: The server calls .push() on modules["Group Members"] and modules["Layers"] without checking if they are arrays. When these fields are booleans or missing, it crashes.

What works (201):

{
  "modules": {
    "Metadata": true,
    "Group Members": ["userId1"],
    "QuickType": true,
    "Tools": true,
    "Layers": [{"layerId": {"withAnnotations": true}}]
  }
}

Also works with empty arrays: "Group Members": [], "Layers": [] → 201 ✓

What crashes (500):

{
  "modules": {
    "Metadata": true,
    "Group Members": true,
    "Tools": true,
    "Layers": true
  }
}

→ 500: "modules.Group Members.push is not a function"

Why Interfaces users don't hit this: The component (copy-project-with-customization/index.js) initializes "Group Members": true and "Layers": true as defaults, but always overwrites them to arrays on lines 470-471 before sending:

modules["Layers"] = this.shadowRoot.getElementById("Layers").checked ? layersSelect : []
modules["Group Members"] = this.shadowRoot.getElementById("Group Members").checked ? groupMembersSelect : []

There is no code path that sends the boolean defaults.

Downgrading severity from Major to Minor. Users won't hit this through the UI. The server should still validate that Group Members and Layers are arrays and return 400 instead of crashing with 500.