refactor(frontend): replace all as-unknown-as error casts with extractErrorCode

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/java/org/raddatz/familienarchiv/document/Document.java

@@ -25,11 +25,14 @@ import java.util.UUID;
 @NamedEntityGraph(name = "Document.full", attributeNodes = {
         @NamedAttributeNode("sender"),
         @NamedAttributeNode("receivers"),
-        @NamedAttributeNode("tags")
+        @NamedAttributeNode("tags"),
+        @NamedAttributeNode("trainingLabels")
 })
 @NamedEntityGraph(name = "Document.list", attributeNodes = {
         @NamedAttributeNode("sender"),
-        @NamedAttributeNode("tags")
+        @NamedAttributeNode("receivers"),
+        @NamedAttributeNode("tags"),
+        @NamedAttributeNode("trainingLabels")
 })
 @Entity
 @Table(name = "documents")

backend/src/main/java/org/raddatz/familienarchiv/document/transcription/TranscriptionBlockController.java

@@ -43,7 +43,7 @@ public class TranscriptionBlockController {
 
     @PostMapping
     @ResponseStatus(HttpStatus.CREATED)
-    @RequirePermission(Permission.WRITE_ALL)
+    @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public TranscriptionBlock createBlock(
             @PathVariable UUID documentId,
             @Valid @RequestBody CreateTranscriptionBlockDTO dto,
@@ -53,7 +53,7 @@ public class TranscriptionBlockController {
     }
 
     @PutMapping("/{blockId}")
-    @RequirePermission(Permission.WRITE_ALL)
+    @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public TranscriptionBlock updateBlock(
             @PathVariable UUID documentId,
             @PathVariable UUID blockId,
@@ -65,7 +65,7 @@ public class TranscriptionBlockController {
 
     @DeleteMapping("/{blockId}")
     @ResponseStatus(HttpStatus.NO_CONTENT)
-    @RequirePermission(Permission.WRITE_ALL)
+    @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public void deleteBlock(
             @PathVariable UUID documentId,
             @PathVariable UUID blockId) {
@@ -73,7 +73,7 @@ public class TranscriptionBlockController {
     }
 
     @PutMapping("/reorder")
-    @RequirePermission(Permission.WRITE_ALL)
+    @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public List<TranscriptionBlock> reorderBlocks(
             @PathVariable UUID documentId,
             @RequestBody ReorderTranscriptionBlocksDTO dto) {
@@ -82,7 +82,7 @@ public class TranscriptionBlockController {
     }
 
     @PutMapping("/{blockId}/review")
-    @RequirePermission(Permission.WRITE_ALL)
+    @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public TranscriptionBlock reviewBlock(
             @PathVariable UUID documentId,
             @PathVariable UUID blockId,
@@ -92,7 +92,7 @@ public class TranscriptionBlockController {
     }
 
     @PutMapping("/review-all")
-    @RequirePermission(Permission.WRITE_ALL)
+    @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public List<TranscriptionBlock> markAllBlocksReviewed(
             @PathVariable UUID documentId,
             Authentication authentication) {

frontend/src/lib/document/BulkDocumentEditLayout.svelte

@@ -17,6 +17,7 @@ import PdfViewer from '$lib/document/viewer/PdfViewer.svelte';
 import { bulkTitleFromFilename } from '$lib/document/filename';
 import type { Tag } from '$lib/tag/TagInput.svelte';
 import type { components } from '$lib/generated/api';
+import { withCsrf } from '$lib/shared/cookies';
 
 type Person = components['schemas']['Person'];
 
@@ -183,7 +184,10 @@ async function saveUpload() {
 		// FormData with per-chunk progress. Session cookie is sent automatically
 		// by the browser for same-origin requests.
 		try {
-			const res = await fetch('/api/documents/quick-upload', { method: 'POST', body: formData });
+			const res = await fetch(
+				'/api/documents/quick-upload',
+				withCsrf({ method: 'POST', body: formData })
+			);
 			const body = await res.json().catch(() => ({ errors: [] }));
 			const errorFilenames = new Set<string>(
 				(body.errors ?? []).map((err: { filename: string }) => err.filename)

frontend/src/lib/document/transcription/TranscriptionEditView.svelte

@@ -6,6 +6,7 @@ import TranscribeCoachEmptyState from '$lib/shared/help/TranscribeCoachEmptyStat
 import type { PersonMention, TranscriptionBlockData } from '$lib/shared/types';
 import { createBlockAutoSave } from '$lib/document/transcription/useBlockAutoSave.svelte';
 import { createBlockDragDrop } from '$lib/document/transcription/useBlockDragDrop.svelte';
+import { withCsrf } from '$lib/shared/cookies';
 
 type Props = {
 	documentId: string;
@@ -109,11 +110,14 @@ function handleDelete(blockId: string) {
 
 async function reorder(newOrder: string[]) {
 	try {
-		const res = await fetch(`/api/documents/${documentId}/transcription-blocks/reorder`, {
+		const res = await fetch(
+			`/api/documents/${documentId}/transcription-blocks/reorder`,
+			withCsrf({
 				method: 'PUT',
 				headers: { 'Content-Type': 'application/json' },
 				body: JSON.stringify({ blockIds: newOrder })
-		});
+			})
+		);
 		if (!res.ok) return;
 		const updated = await res.json();
 		for (const b of updated) {

frontend/src/lib/document/transcription/useBlockAutoSave.svelte.ts

@@ -1,5 +1,6 @@
 import { SvelteMap } from 'svelte/reactivity';
 import type { PersonMention } from '$lib/shared/types';
+import { withCsrf } from '$lib/shared/cookies';
 
 export type SaveState = 'idle' | 'saving' | 'saved' | 'fading' | 'error';
 
@@ -116,12 +117,15 @@ export function createBlockAutoSave({ saveFn, documentId }: Options) {
 		for (const [blockId, text] of pendingTexts) {
 			const mentions = pendingMentions.get(blockId) ?? [];
 			clearDebounce(blockId);
-			void fetch(`/api/documents/${documentId}/transcription-blocks/${blockId}`, {
+			void fetch(
+				`/api/documents/${documentId}/transcription-blocks/${blockId}`,
+				withCsrf({
 					method: 'PUT',
 					headers: { 'Content-Type': 'application/json' },
 					body: JSON.stringify({ text, mentionedPersons: mentions }),
 					keepalive: true
-			});
+				})
+			);
 			pendingTexts.delete(blockId);
 			pendingMentions.delete(blockId);
 		}

frontend/src/lib/document/transcription/useTranscriptionBlocks.svelte.ts

@@ -2,6 +2,7 @@
    lastEditedAt's $derived are scope-local to one computation; they're never
    stored on $state. */
 import type { TranscriptionBlockData, PersonMention } from '$lib/shared/types';
+import { makeCsrfFetch } from '$lib/shared/cookies';
 import { saveBlockWithConflictRetry } from './saveBlockWithConflictRetry';
 import { BlockConflictResolvedError } from './blockConflictMerge';
 
@@ -41,7 +42,7 @@ export function createTranscriptionBlocks(
 	options: TranscriptionBlocksOptions
 ): TranscriptionBlocksController {
 	const { documentId } = options;
-	const fetchImpl = options.fetchImpl ?? fetch;
+	const fetchImpl = makeCsrfFetch(options.fetchImpl ?? fetch);
 
 	let blocks = $state<TranscriptionBlockData[]>([]);
 	let annotationReloadKey = $state(0);

frontend/src/lib/ocr/OcrTrainingCard.svelte

@@ -2,6 +2,7 @@
 import TrainingHistory from './TrainingHistory.svelte';
 import { m } from '$lib/paraglide/messages.js';
 import type { TrainingRun } from '$lib/ocr/training.js';
+import { withCsrf } from '$lib/shared/cookies';
 
 interface TrainingInfo {
 	availableBlocks?: number;
@@ -33,7 +34,7 @@ async function startTraining() {
 	successMessage = null;
 	errorMessage = null;
 	try {
-		const res = await fetch('/api/ocr/train', { method: 'POST' });
+		const res = await fetch('/api/ocr/train', withCsrf({ method: 'POST' }));
 		if (res.ok) {
 			successMessage = m.training_success();
 			setTimeout(() => {

frontend/src/lib/ocr/SegmentationTrainingCard.svelte

@@ -2,6 +2,7 @@
 import TrainingHistory from './TrainingHistory.svelte';
 import { m } from '$lib/paraglide/messages.js';
 import type { TrainingRun } from '$lib/ocr/training.js';
+import { withCsrf } from '$lib/shared/cookies';
 
 interface TrainingInfo {
 	availableSegBlocks?: number;
@@ -27,7 +28,7 @@ async function startTraining() {
 	training = true;
 	successMessage = null;
 	try {
-		const res = await fetch('/api/ocr/segtrain', { method: 'POST' });
+		const res = await fetch('/api/ocr/segtrain', withCsrf({ method: 'POST' }));
 		if (res.ok) {
 			successMessage = m.training_success();
 			setTimeout(() => {

frontend/src/lib/shared/api.server.spec.ts

@@ -0,0 +1,20 @@
+import { describe, it, expect } from 'vitest';
+import { extractErrorCode } from './api.server';
+
+describe('extractErrorCode', () => {
+	it('returns the code string when error has a code property', () => {
+		expect(extractErrorCode({ code: 'DOCUMENT_NOT_FOUND' })).toBe('DOCUMENT_NOT_FOUND');
+	});
+	it('returns undefined when error is undefined', () => {
+		expect(extractErrorCode(undefined)).toBeUndefined();
+	});
+	it('returns undefined when error is null', () => {
+		expect(extractErrorCode(null)).toBeUndefined();
+	});
+	it('returns undefined when error is a plain string', () => {
+		expect(extractErrorCode('oops')).toBeUndefined();
+	});
+	it('returns undefined when error object has no code property', () => {
+		expect(extractErrorCode({ message: 'fail' })).toBeUndefined();
+	});
+});

frontend/src/lib/shared/api.server.ts

@@ -23,3 +23,12 @@ export function createApiClient(fetch: typeof globalThis.fetch) {
 		fetch
 	});
 }
+
+export interface ApiError {
+	code?: string;
+	message?: string;
+}
+
+export function extractErrorCode(error: unknown): string | undefined {
+	return (error as ApiError | undefined)?.code;
+}

frontend/src/lib/shared/cookies.ts

@@ -1,3 +1,46 @@
+/**
+ * Reads the XSRF-TOKEN cookie set by Spring Security's CookieCsrfTokenRepository.
+ * Returns null outside the browser or when the cookie is absent.
+ */
+export function getCsrfToken(): string | null {
+	if (typeof document === 'undefined') return null;
+	const match = document.cookie.match(/(?:^|;\s*)XSRF-TOKEN=([^;]+)/);
+	return match ? decodeURIComponent(match[1]) : null;
+}
+
+/**
+ * Merges the X-XSRF-TOKEN header into a RequestInit so Spring Security's
+ * CSRF filter accepts the request. Safe to call server-side (no-op when the
+ * cookie is absent).
+ */
+export function withCsrf(init?: RequestInit): RequestInit {
+	const token = getCsrfToken();
+	if (!token) return init ?? {};
+	const headers = new Headers(init?.headers);
+	headers.set('X-XSRF-TOKEN', token);
+	return { ...init, headers };
+}
+
+/**
+ * Wraps a fetch implementation so that every state-mutating call (POST, PUT,
+ * PATCH, DELETE) automatically includes the X-XSRF-TOKEN header. GET/HEAD
+ * requests pass through unchanged.
+ *
+ * Used to CSRF-protect client-side hooks that accept an injectable fetchImpl.
+ * In unit tests the injected mock is wrapped but getCsrfToken() returns null
+ * (no browser cookie), so no header is added and existing test expectations
+ * are unaffected.
+ */
+export function makeCsrfFetch(inner: typeof fetch): typeof fetch {
+	return (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+		const method = (init?.method ?? 'GET').toUpperCase();
+		if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
+			return inner(input, withCsrf(init));
+		}
+		return inner(input, init);
+	};
+}
+
 /**
  * Extracts the fa_session cookie value from a list of Set-Cookie response headers.
  *

frontend/src/routes/admin/+layout.server.ts

@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import { env } from '$env/dynamic/private';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { components } from '$lib/generated/api';
 
@@ -34,16 +34,16 @@ export async function load({ fetch, locals }) {
 	]);
 
 	if (!usersResult.response.ok) {
-		const code = (usersResult.error as unknown as { code?: string })?.code;
+		throw error(usersResult.response.status, getErrorMessage(extractErrorCode(usersResult.error)));
-		throw error(usersResult.response.status, getErrorMessage(code));
 	}
 	if (!groupsResult.response.ok) {
-		const code = (groupsResult.error as unknown as { code?: string })?.code;
+		throw error(
-		throw error(groupsResult.response.status, getErrorMessage(code));
+			groupsResult.response.status,
+			getErrorMessage(extractErrorCode(groupsResult.error))
+		);
 	}
 	if (!tagsResult.response.ok) {
-		const code = (tagsResult.error as unknown as { code?: string })?.code;
+		throw error(tagsResult.response.status, getErrorMessage(extractErrorCode(tagsResult.error)));
-		throw error(tagsResult.response.status, getErrorMessage(code));
 	}
 
 	let inviteCount = 0;

frontend/src/routes/admin/groups/[id]/+page.server.ts

@@ -1,6 +1,6 @@
 import { error, fail, redirect } from '@sveltejs/kit';
 import type { PageServerLoad, Actions } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const load: PageServerLoad = async ({ params, parent }) => {
@@ -24,8 +24,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		return { success: true };
@@ -38,8 +39,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, '/admin/groups');

frontend/src/routes/admin/groups/new/+page.server.ts

@@ -1,6 +1,6 @@
 import { fail, redirect } from '@sveltejs/kit';
 import type { Actions } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const actions: Actions = {
@@ -16,8 +16,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, '/admin/groups');

frontend/src/routes/admin/invites/+page.server.ts

@@ -1,5 +1,5 @@
 import { fail } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { Actions, PageServerLoad } from './$types';
 import type { components } from '$lib/generated/api';
@@ -25,8 +25,7 @@ export const load: PageServerLoad = async ({ url, fetch }) => {
 	let invites: InviteListItem[] = [];
 	let loadError: string | null = null;
 	if (!invitesResult.response.ok) {
-		const code = (invitesResult.error as unknown as { code?: string })?.code;
+		loadError = extractErrorCode(invitesResult.error) ?? 'INTERNAL_ERROR';
-		loadError = code ?? 'INTERNAL_ERROR';
 	} else {
 		invites = (invitesResult.data ?? []) as InviteListItem[];
 	}
@@ -34,8 +33,7 @@ export const load: PageServerLoad = async ({ url, fetch }) => {
 	let groups: UserGroup[] = [];
 	let groupsLoadError: string | null = null;
 	if (!groupsResult.response.ok) {
-		const code = (groupsResult.error as unknown as { code?: string })?.code;
+		groupsLoadError = extractErrorCode(groupsResult.error) ?? 'INTERNAL_ERROR';
-		groupsLoadError = code ?? 'INTERNAL_ERROR';
 	} else {
 		const raw = groupsResult.data ?? [];
 		groups = [...raw].sort((a, b) => a.name.localeCompare(b.name));
@@ -62,8 +60,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { createError: code ?? 'INTERNAL_ERROR' });
+				createError: extractErrorCode(result.error) ?? 'INTERNAL_ERROR'
+			});
 		}
 
 		return { created: result.data! as InviteListItem };
@@ -78,8 +77,9 @@ export const actions = {
 		const result = await api.DELETE('/api/invites/{id}', { params: { path: { id } } });
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { revokeError: code ?? 'INTERNAL_ERROR' });
+				revokeError: extractErrorCode(result.error) ?? 'INTERNAL_ERROR'
+			});
 		}
 
 		return { revoked: id };

frontend/src/routes/admin/ocr/+page.server.ts

@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const load: PageServerLoad = async ({ fetch }) => {
@@ -8,8 +8,7 @@ export const load: PageServerLoad = async ({ fetch }) => {
 	const result = await api.GET('/api/ocr/training-info');
 
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 
 	return { trainingInfo: result.data! };

frontend/src/routes/admin/ocr/[personId]/+page.server.ts

@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const load: PageServerLoad = async ({ params, fetch }) => {
@@ -10,8 +10,7 @@ export const load: PageServerLoad = async ({ params, fetch }) => {
 	});
 
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 
 	return { history: result.data!, personId: params.personId };

frontend/src/routes/admin/ocr/global/+page.server.ts

@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const load: PageServerLoad = async ({ fetch }) => {
@@ -8,8 +8,7 @@ export const load: PageServerLoad = async ({ fetch }) => {
 	const result = await api.GET('/api/ocr/training-info/global');
 
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 
 	return { history: result.data! };

frontend/src/routes/admin/tags/[id]/+page.server.ts

@@ -1,6 +1,6 @@
 import { error, fail, redirect } from '@sveltejs/kit';
 import type { PageServerLoad, Actions } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const load: PageServerLoad = async ({ params, parent, url }) => {
@@ -25,8 +25,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		return { success: true };
@@ -43,8 +44,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, `/admin/tags/${result.data!.id}?merged=1`);
@@ -65,8 +67,9 @@ export const actions: Actions = {
 					});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, '/admin/tags');

frontend/src/routes/admin/users/[id]/+page.server.ts

@@ -1,6 +1,6 @@
 import { error, fail, redirect } from '@sveltejs/kit';
 import type { PageServerLoad, Actions } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { components } from '$lib/generated/api';
 
@@ -55,8 +55,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		return { success: true };
@@ -69,8 +70,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, '/admin/users');

frontend/src/routes/admin/users/new/+page.server.ts

@@ -1,6 +1,6 @@
 import { error, fail, redirect } from '@sveltejs/kit';
 import type { PageServerLoad, Actions } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const load: PageServerLoad = async ({ fetch, locals }) => {
@@ -35,8 +35,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, '/admin/users');

frontend/src/routes/aktivitaeten/+page.server.ts

@@ -1,5 +1,5 @@
 import { fail } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { components, operations } from '$lib/generated/api';
 
@@ -79,8 +79,9 @@ export const actions = {
 			params: { path: { id: notificationId } }
 		});
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 		return { success: true };
 	},
@@ -89,8 +90,9 @@ export const actions = {
 		const api = createApiClient(fetch);
 		const result = await api.POST('/api/notifications/read-all');
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 		return { success: true };
 	}

frontend/src/routes/briefwechsel/+page.server.ts

@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import type { components } from '$lib/generated/api';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export async function load({ url, fetch, locals }) {
@@ -39,8 +39,7 @@ export async function load({ url, fetch, locals }) {
 				})
 				.then((result) => {
 					if (!result.response.ok) {
-						const code = (result.error as unknown as { code?: string })?.code;
+						throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-						throw error(result.response.status, getErrorMessage(code));
 					}
 					documents = result.data ?? [];
 				})
@@ -49,8 +48,7 @@ export async function load({ url, fetch, locals }) {
 		requests.push(
 			api.GET('/api/persons/{id}', { params: { path: { id: senderId } } }).then((result) => {
 				if (!result.response.ok) {
-					const code = (result.error as unknown as { code?: string })?.code;
+					throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-					throw error(result.response.status, getErrorMessage(code));
 				}
 				const p = result.data as { displayName: string } | undefined;
 				if (p) senderName = p.displayName;
@@ -62,8 +60,7 @@ export async function load({ url, fetch, locals }) {
 		requests.push(
 			api.GET('/api/persons/{id}', { params: { path: { id: receiverId } } }).then((result) => {
 				if (!result.response.ok) {
-					const code = (result.error as unknown as { code?: string })?.code;
+					throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-					throw error(result.response.status, getErrorMessage(code));
 				}
 				const p = result.data as { displayName: string } | undefined;
 				if (p) receiverName = p.displayName;

frontend/src/routes/documents/+page.server.ts

@@ -1,5 +1,5 @@
 import { redirect } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { components } from '$lib/generated/api';
 
@@ -103,8 +103,7 @@ export async function load({ url, fetch }) {
 	}
 
 	const errorMessage: string | null = !result.response.ok
-		? (getErrorMessage((result.error as unknown as { code?: string })?.code) ??
+		? (getErrorMessage(extractErrorCode(result.error)) ?? 'Daten konnten nicht geladen werden.')
-			'Daten konnten nicht geladen werden.')
 		: null;
 
 	return {

frontend/src/routes/documents/[id]/+page.server.ts

@@ -1,5 +1,5 @@
 import { error, redirect } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import { inferredRelationshipLabel } from '$lib/person/relationshipLabels';
 
@@ -17,8 +17,7 @@ export async function load({ params, fetch }) {
 	if (docResult.response.status === 401) throw redirect(302, '/login');
 
 	if (!docResult.response.ok) {
-		const code = (docResult.error as unknown as { code?: string })?.code;
+		throw error(docResult.response.status, getErrorMessage(extractErrorCode(docResult.error)));
-		throw error(docResult.response.status, getErrorMessage(code));
 	}
 
 	const document = docResult.data!;

frontend/src/routes/documents/[id]/edit/+page.server.ts

@@ -1,6 +1,6 @@
 import { error, fail, redirect } from '@sveltejs/kit';
 import { env } from '$env/dynamic/private';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { parseBackendError, getErrorMessage } from '$lib/shared/errors';
 
 export async function load({
@@ -30,8 +30,7 @@ export async function load({
 	]);
 
 	if (!docResult.response.ok) {
-		const code = (docResult.error as unknown as { code?: string })?.code;
+		throw error(docResult.response.status, getErrorMessage(extractErrorCode(docResult.error)));
-		throw error(docResult.response.status, getErrorMessage(code));
 	}
 	if (!personsResult.response.ok) {
 		throw error(personsResult.response.status, getErrorMessage('INTERNAL_ERROR'));
@@ -76,8 +75,9 @@ export const actions = {
 		// Fetch current document to preserve all existing fields
 		const docResult = await api.GET('/api/documents/{id}', { params: { path: { id: params.id } } });
 		if (!docResult.response.ok) {
-			const code = (docResult.error as unknown as { code?: string })?.code;
+			return fail(docResult.response.status, {
-			return fail(docResult.response.status, { error: getErrorMessage(code) });
+				error: getErrorMessage(extractErrorCode(docResult.error))
+			});
 		}
 
 		const doc = docResult.data!;

frontend/src/routes/enrich/[id]/+page.server.ts

@@ -1,6 +1,6 @@
 import { error, redirect } from '@sveltejs/kit';
 import { env } from '$env/dynamic/private';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage, parseBackendError } from '$lib/shared/errors';
 
 export async function load({
@@ -31,8 +31,7 @@ export async function load({
 	]);
 
 	if (!docResult.response.ok) {
-		const code = (docResult.error as unknown as { code?: string })?.code;
+		throw error(docResult.response.status, getErrorMessage(extractErrorCode(docResult.error)));
-		throw error(docResult.response.status, getErrorMessage(code));
 	}
 
 	const incompleteCount = countResult.response.ok ? (countResult.data?.count ?? 0) : 0;

frontend/src/routes/geschichten/+page.server.ts

@@ -1,5 +1,5 @@
 import { error } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { components } from '$lib/generated/api';
 import type { PageServerLoad } from './$types';
@@ -25,8 +25,7 @@ export const load: PageServerLoad = async ({ url, fetch }) => {
 	]);
 
 	if (!listResult.response.ok) {
-		const code = (listResult.error as unknown as { code?: string })?.code;
+		throw error(listResult.response.status, getErrorMessage(extractErrorCode(listResult.error)));
-		throw error(listResult.response.status, getErrorMessage(code));
 	}
 
 	const personFilters = personResults

frontend/src/routes/geschichten/[id]/+page.server.ts

@@ -1,5 +1,5 @@
 import { error } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { PageServerLoad } from './$types';
 
@@ -9,8 +9,7 @@ export const load: PageServerLoad = async ({ params, fetch }) => {
 		params: { path: { id: params.id } }
 	});
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 	return { geschichte: result.data! };
 };

frontend/src/routes/geschichten/[id]/edit/+page.server.ts

@@ -1,5 +1,5 @@
 import { error, redirect } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import type { PageServerLoad } from './$types';
 
@@ -13,8 +13,7 @@ export const load: PageServerLoad = async ({ params, fetch, parent }) => {
 		params: { path: { id: params.id } }
 	});
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 	return { geschichte: result.data! };
 };

frontend/src/routes/persons/[id]/+page.server.ts

@@ -1,5 +1,5 @@
 import { error } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export async function load({ params, fetch, locals }) {
@@ -32,8 +32,10 @@ export async function load({ params, fetch, locals }) {
 	]);
 
 	if (!personResult.response.ok) {
-		const code = (personResult.error as unknown as { code?: string })?.code;
+		throw error(
-		throw error(personResult.response.status, getErrorMessage(code));
+			personResult.response.status,
+			getErrorMessage(extractErrorCode(personResult.error))
+		);
 	}
 
 	return {

frontend/src/routes/persons/[id]/edit/+page.server.ts

@@ -1,5 +1,5 @@
 import { error, fail, redirect } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import {
 	normalizePersonType,
@@ -25,8 +25,7 @@ export async function load({ params, fetch, locals }) {
 	]);
 
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 
 	const person = result.data!;
@@ -74,8 +73,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { updateError: getErrorMessage(code) });
+				updateError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, `/persons/${params.id}`);
@@ -100,8 +100,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { mergeError: getErrorMessage(code) });
+				mergeError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		throw redirect(303, `/persons/${targetPersonId}`);
@@ -127,8 +128,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { aliasError: getErrorMessage(code) });
+				aliasError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		return { aliasSuccess: true };
@@ -148,8 +150,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { aliasError: getErrorMessage(code) });
+				aliasError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		return { aliasSuccess: true };
@@ -166,8 +169,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { relationshipError: getErrorMessage(code) });
+				relationshipError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 		return { relationshipSuccess: true };
 	},
@@ -211,8 +215,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { relationshipError: getErrorMessage(code) });
+				relationshipError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 		return { relationshipSuccess: true };
 	},
@@ -230,8 +235,9 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { relationshipError: getErrorMessage(code) });
+				relationshipError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 		return { relationshipSuccess: true };
 	}

frontend/src/routes/persons/new/+page.server.ts

@@ -1,5 +1,5 @@
 import { error, fail, redirect } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 import {
 	normalizePersonType,
@@ -57,9 +57,8 @@ export const actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
 			return fail(result.response.status, {
-				error: getErrorMessage(code),
+				error: getErrorMessage(extractErrorCode(result.error)),
 				personType,
 				title,
 				firstName,

frontend/src/routes/profile/+page.server.ts

@@ -1,7 +1,7 @@
 import { fail } from '@sveltejs/kit';
 import { env } from '$env/dynamic/private';
 import type { PageServerLoad, Actions } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 const apiBase = () => env.API_INTERNAL_URL || 'http://localhost:8080';
@@ -27,8 +27,9 @@ export const actions: Actions = {
 		const result = await api.PUT('/api/users/me', { body });
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { updateError: getErrorMessage(code) });
+				updateError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		return { updateSuccess: true };
@@ -50,8 +51,9 @@ export const actions: Actions = {
 		});
 
 		if (!result.response.ok) {
-			const code = (result.error as unknown as { code?: string })?.code;
+			return fail(result.response.status, {
-			return fail(result.response.status, { passwordError: getErrorMessage(code) });
+				passwordError: getErrorMessage(extractErrorCode(result.error))
+			});
 		}
 
 		return { passwordSuccess: true };

frontend/src/routes/stammbaum/+page.server.ts

@@ -1,5 +1,5 @@
 import { error, redirect } from '@sveltejs/kit';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export async function load({ fetch }) {
@@ -9,8 +9,7 @@ export async function load({ fetch }) {
 	if (result.response.status === 401) throw redirect(302, '/login');
 
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 
 	const network = result.data!;

frontend/src/routes/users/[id]/+page.server.ts

@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
-import { createApiClient } from '$lib/shared/api.server';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
 import { getErrorMessage } from '$lib/shared/errors';
 
 export const load: PageServerLoad = async ({ params, fetch }) => {
@@ -8,8 +8,7 @@ export const load: PageServerLoad = async ({ params, fetch }) => {
 	const result = await api.GET('/api/users/{id}', { params: { path: { id: params.id } } });
 
 	if (!result.response.ok) {
-		const code = (result.error as unknown as { code?: string })?.code;
+		throw error(result.response.status, getErrorMessage(extractErrorCode(result.error)));
-		throw error(result.response.status, getErrorMessage(code));
 	}
 
 	return { profileUser: result.data! };