wtclaude
565a7d2c20
The last split PR of docs/website/API_V2_PLAN.md § Phase 2. public.routes.js,
player.routes.js and auth.routes.js are deleted; each group is now a directory
whose index.js owns the group gate and the mount table and declares no routes.
Every one of the 200 manifest routes is now in a capability router.
public/ posts (2) wiki (4) pages (2) shard (12) site (4, group root)
player/ account (8) shard (8) appeals (4), behind noindex + requireAuth
auth/ login (2) register (1) invite (2) password (3) session (2, root)
No URL moves. All four gates zero-diff: routes.manifest.json (200 public + 2
internal), routes.guards.json, swagger-output.json (198 operations), and
docs/website/api-route-inventory.json was already in sync. 434 tests green.
Notes on the non-mechanical parts:
- public/index.js and auth/index.js carry no group gate, deliberately, and say
so. The public surface is anonymous by contract (logged-out SPA, Discord bot,
Android ShardStreamClient on /public/shard/stream); /auth is where a caller
becomes authenticated. player/index.js gates on requireAuth only, never
requireRole('player') — staff are a superset of players.
- GET /auth/me has a mount-order dependency: use('/me', meRouter) matches the
bare /me, so the request runs meRouter's noindex + requireAuth and falls
through. session.router.js must stay mounted last. Verified by the
counterfactual — mounting it first still 401s but drops X-Robots-Tag, which
no manifest or guards file can see.
- loginGuards moved to auth/loginGuards.js (frozen) rather than being copied
into the three routers that spread it; sso.routes.js drops its duplicate.
- The :param shadowing check was re-run in dispatch order against the built
stack: 86 routes, 64 literal, none shadowed. /public/wiki/{categories,tags}
ahead of /:slug is the only ordering-sensitive pair.
Co-Authored-By: Claude <noreply@anthropic.com>
37 lines
1.7 KiB
JavaScript
37 lines
1.7 KiB
JavaScript
// ── Auth compatibility facade ──────────────────────────────────────────────
|
|
//
|
|
// The auth logic now lives in server/src/auth/ (token primitives, the session
|
|
// service, and session middleware). This module stays as a thin facade so every
|
|
// existing import site (the auth/* and admin/* routers, siteMode, auth.controller)
|
|
// keeps working with the exact same names and behavior — nothing else in the
|
|
// codebase needs to change. New code should prefer requiring ../auth/* directly.
|
|
|
|
const token = require('../auth/token')
|
|
const sessionService = require('../auth/session.service')
|
|
const { requireAuth, requireRole } = require('../auth/session.middleware')
|
|
|
|
// Non-rejecting identity check. Returns the decoded token payload (with `.id`)
|
|
// or null — same shape callers relied on (siteMode only truthiness-checks it).
|
|
// Backed by the session service so there is a single validation path.
|
|
function getUserFromRequest(req) {
|
|
const session = sessionService.validateSession(req)
|
|
if (!session) return null
|
|
// Preserve the historical payload shape (id/username/role) for callers.
|
|
return { id: session.userId, username: session.username, role: session.role }
|
|
}
|
|
|
|
module.exports = {
|
|
COOKIE_NAME: token.COOKIE_NAME,
|
|
// Token primitives (re-exported from auth/token.js).
|
|
signToken: token.signToken,
|
|
verifyToken: token.verifyToken,
|
|
signTotpChallenge: token.signTotpChallenge,
|
|
verifyTotpChallenge: token.verifyTotpChallenge,
|
|
setAuthCookie: token.setAuthCookie,
|
|
clearAuthCookie: token.clearAuthCookie,
|
|
// Request helpers / middleware.
|
|
getUserFromRequest,
|
|
isLoggedIn: requireAuth, // old name → new middleware, identical behavior
|
|
requireRole,
|
|
}
|