The legacy client requests an Etherpad session on every topic page whose lesson has contents, without ever checking whether the lesson contains a pad — controllers/topics.js collects `etherpadPads` and then ignores it. With Etherpad unreachable the request fails, `validUntil` comes back undefined, and `new Date(undefined * 1000)` makes Express reject the session cookie: "option expires is invalid", rendered as a 500. So Etherpad was only nominally optional. Moving it out of the `tools` profile also matches the live deployment, which always runs it. The topic pages that still 500 are courses the signed-in user is not a member of; the same page returns 200 for its own teacher. That is the legacy client rendering a 403 as a 500, upstream behaviour we don't own. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
9.8 KiB
9.8 KiB