test

        }

    }

    writeJson(curreq, HTTP200, matched->handler(ctx));

    std::string result = matched->handler(ctx);

    // Handlers signal failure by returning jsonError(...) rather than throwing, but that's

    // just a plain string -- without checking for it here, every validation/auth failure from

    // every handler (bad login credentials included) went out as HTTP200, so fetch()'s

    // res.ok check on the client never caught it (see admin/static/app.js's api() helper).

    JsonGuard resultObj(json_tokener_parse(result.c_str()));

    if (resultObj.obj && json_object_object_get(resultObj.obj, "error")) {

        const char *status = matched->path == "/api/v1/auth/login" ? HTTP401 : HTTP400;

        writeJson(curreq, status, result);

        return;

    }

    writeJson(curreq, HTTP200, result);

}

JsonApiServer::JsonApiServer(config::AppConfig cfg, std::string staticDir, std::string certPath,