wtclaude
565a7d2c20
The last split PR of docs/website/API_V2_PLAN.md § Phase 2. public.routes.js,
player.routes.js and auth.routes.js are deleted; each group is now a directory
whose index.js owns the group gate and the mount table and declares no routes.
Every one of the 200 manifest routes is now in a capability router.
public/ posts (2) wiki (4) pages (2) shard (12) site (4, group root)
player/ account (8) shard (8) appeals (4), behind noindex + requireAuth
auth/ login (2) register (1) invite (2) password (3) session (2, root)
No URL moves. All four gates zero-diff: routes.manifest.json (200 public + 2
internal), routes.guards.json, swagger-output.json (198 operations), and
docs/website/api-route-inventory.json was already in sync. 434 tests green.
Notes on the non-mechanical parts:
- public/index.js and auth/index.js carry no group gate, deliberately, and say
so. The public surface is anonymous by contract (logged-out SPA, Discord bot,
Android ShardStreamClient on /public/shard/stream); /auth is where a caller
becomes authenticated. player/index.js gates on requireAuth only, never
requireRole('player') — staff are a superset of players.
- GET /auth/me has a mount-order dependency: use('/me', meRouter) matches the
bare /me, so the request runs meRouter's noindex + requireAuth and falls
through. session.router.js must stay mounted last. Verified by the
counterfactual — mounting it first still 401s but drops X-Robots-Tag, which
no manifest or guards file can see.
- loginGuards moved to auth/loginGuards.js (frozen) rather than being copied
into the three routers that spread it; sso.routes.js drops its duplicate.
- The :param shadowing check was re-run in dispatch order against the built
stack: 86 routes, 64 literal, none shadowed. /public/wiki/{categories,tags}
ahead of /:slug is the only ordering-sensitive pair.
Co-Authored-By: Claude <noreply@anthropic.com>
44 lines
1.9 KiB
JavaScript
44 lines
1.9 KiB
JavaScript
// /api/v1/player — the player self-service surface, assembled from
|
|
// per-capability routers.
|
|
//
|
|
// This file owns exactly two things: the gate every player route shares, and the
|
|
// mount table. No route is declared here. Each capability router mounts at the
|
|
// prefix it already owned inside the old monolithic player.routes.js, so the
|
|
// emitted URL set is byte-identical — proved by a zero-line diff in
|
|
// server/routes.manifest.json (`npm run routes:manifest`).
|
|
//
|
|
// **Staff are a superset of players.** This group is open to any authenticated
|
|
// account, not just role 'player': every read/write is self-scoped to req.user.id,
|
|
// and a staff member has every player ability plus their staff tools on top.
|
|
// Adding a requireRole('player') here would 403 an admin off their own characters
|
|
// (it happened once — see docs/website/BACKEND_DESIGN.md). Staff also reach the
|
|
// identical self-scoped handlers under /admin/shard and /auth/me/account; those
|
|
// are alternative URLs onto the same controllers, not duplicated logic.
|
|
//
|
|
// See docs/website/API_V2_PLAN.md § Phase 2 for the split.
|
|
|
|
const express = require('express')
|
|
|
|
const { requireAuth } = require('../../../auth/session.middleware')
|
|
const noindex = require('../../../middleware/noindex')
|
|
|
|
const accountRouter = require('./account.router')
|
|
const shardRouter = require('./shard.router')
|
|
const appealsRouter = require('./appeals.router')
|
|
|
|
const playerRouter = express.Router()
|
|
|
|
// Group gate: authenticated only (no role restriction). Keep it out of search
|
|
// indexes. requireAuth also enforces the account status check (a disabled/banned
|
|
// account is rejected here with 403 before any handler runs).
|
|
//
|
|
// It lives here, ahead of every mount, so a capability router added later cannot
|
|
// silently ship without it.
|
|
playerRouter.use(noindex, requireAuth)
|
|
|
|
playerRouter.use('/account', accountRouter)
|
|
playerRouter.use('/shard', shardRouter)
|
|
playerRouter.use('/appeals', appealsRouter)
|
|
|
|
module.exports = playerRouter
|