fix(wab): return 401 instead of 500 for logged-out personal API token calls

[jameswillis99]

Summary

A logged-out request to the personal API token routes (GET / PUT /api/v1/settings/apitokens) returns a 500 with NullOrUndefinedValueError. It now returns a 401.

 checkUserIdIsSelf(userId)
   if NormalUser: userId = actor.userId
   if SuperUser and no userId: throw
-  return ensure(userId)            // 500 NullOrUndefinedValueError
+  if no userId: throw UnauthorizedError   // 401
+  return userId

Evidence

DbMgr.user › rejects personal API token calls from anonymous users

anonymous listPersonalApiTokens() / createPersonalApiToken()
  expect rejects with UnauthorizedError

• Before: fails, expected NullOrUndefinedValueError … to be an instance of UnauthorizedError
  After: passes. Full DbMgr.spec.ts: 56 passed, 2 skipped

Merge Danger

Door: two-way

Blast Radius: small

Only the error thrown when there is no user id changes. The same check guards the token routes, updateUser, updateAdminMode and claimPublicProject. Logged-in users are not affected.

[vercel]

@jwillis24 is attempting to deploy a commit to the Plasmic Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thank you for your submission, we really appreciate it! ❤️

Like many open-source projects, we ask that you sign our Individual Contributor License Agreement before we can accept your contribution. If you are contributing on behalf of a company, please contact us at help@plasmic.app to sign a Corporate Contributor License Agreement.

You can sign the individual CLA by posting a comment with the below text.

---

I have read, agree to, and hereby sign Plasmic's Individual Contributor License Agreement

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}