export async function getApi(constructor = Gists) {
  const token = await getToken();
  const apiurl = config.get("apiUrl");

  if (!apiurl) {
    const message = "No API URL is set.";
    throw new Error(message);
  }

  return new constructor({ apiurl, token });
}
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.