Proper 404 Handling for Dynamic Routes (ERR-04)

Release: v0.1.100

Background

Compliance platforms must communicate clearly when a record does not exist. Before this fix, visiting a URL like /dashboard/people/<invalid-id> would render a blank page instead of a 404 error. This silent failure had two problems:

1. User confusion — An empty page looks like a loading failure or data loss, not a missing record.
2. Security signal leakage — The absence of a compliance record (e.g. a person that was screened and then removed) should be handled explicitly, not silently ignored.

What Was Fixed

Branded 404 Page

A global not-found page has been added at src/app/not-found.tsx. Next.js automatically renders this page whenever:

• A route segment calls notFound() from next/navigation.
• A URL does not match any known route.

The page is styled consistently with the rest of the application.

notFound() in Dynamic Route Server Components

Dynamic route server components now perform an explicit existence check before rendering. The pattern used is:

import { notFound } from 'next/navigation';

// Inside the server component:
const person = await db.query(...);

if (!person || person.orgId !== session.orgId) {
  notFound();
}

This applies to:

Route	File
/dashboard/people/[id]	src/app/dashboard/people/[id]/page.tsx
/dashboard/sanctions/changes	Dynamic segments in the sanctions changes route

Behaviour After This Fix

Scenario	Before	After
Valid person ID, belongs to org	Rendered correctly	Rendered correctly
Valid person ID, wrong org	Blank page	404 page
Invalid / non-existent person ID	Blank page	404 page
Unmatched URL	Next.js default 404	Branded 404 page

HTTP Status Codes

Calling notFound() causes Next.js to return an HTTP 404 Not Found status code. This is important for:

• Monitoring and alerting — APM tools can distinguish between application errors and missing resources.
• Caching layers — CDNs and reverse proxies handle 404 responses differently from 200 responses with empty bodies.
• Audit trails — Access logs will correctly record the failed lookup rather than a successful page load.