wtclaude
565a7d2c20
The last split PR of docs/website/API_V2_PLAN.md § Phase 2. public.routes.js,
player.routes.js and auth.routes.js are deleted; each group is now a directory
whose index.js owns the group gate and the mount table and declares no routes.
Every one of the 200 manifest routes is now in a capability router.
public/ posts (2) wiki (4) pages (2) shard (12) site (4, group root)
player/ account (8) shard (8) appeals (4), behind noindex + requireAuth
auth/ login (2) register (1) invite (2) password (3) session (2, root)
No URL moves. All four gates zero-diff: routes.manifest.json (200 public + 2
internal), routes.guards.json, swagger-output.json (198 operations), and
docs/website/api-route-inventory.json was already in sync. 434 tests green.
Notes on the non-mechanical parts:
- public/index.js and auth/index.js carry no group gate, deliberately, and say
so. The public surface is anonymous by contract (logged-out SPA, Discord bot,
Android ShardStreamClient on /public/shard/stream); /auth is where a caller
becomes authenticated. player/index.js gates on requireAuth only, never
requireRole('player') — staff are a superset of players.
- GET /auth/me has a mount-order dependency: use('/me', meRouter) matches the
bare /me, so the request runs meRouter's noindex + requireAuth and falls
through. session.router.js must stay mounted last. Verified by the
counterfactual — mounting it first still 401s but drops X-Robots-Tag, which
no manifest or guards file can see.
- loginGuards moved to auth/loginGuards.js (frozen) rather than being copied
into the three routers that spread it; sso.routes.js drops its duplicate.
- The :param shadowing check was re-run in dispatch order against the built
stack: 86 routes, 64 literal, none shadowed. /public/wiki/{categories,tags}
ahead of /:slug is the only ordering-sensitive pair.
Co-Authored-By: Claude <noreply@anthropic.com>
68 lines
4.0 KiB
JavaScript
68 lines
4.0 KiB
JavaScript
// Public · Site — the four group-root singletons: settings, status, version and
|
|
// contact. None of them owns a path segment that could become a prefix, so this
|
|
// is the public group's counterpart to admin/dashboard.router.js: one file for
|
|
// the routes that own no prefix, mounted at the group root.
|
|
//
|
|
// It is safe at the root **only** because this file declares no router-level
|
|
// middleware. A bare `use(gate)` in a root-mounted router runs for every request
|
|
// passing through toward another mount — it would gate /public/wiki and
|
|
// /public/shard/* too. Keep gates on the individual routes here (siteMode is
|
|
// deliberately absent: settings/status/version/contact must answer during
|
|
// maintenance so the client can render the maintenance page and let a visitor
|
|
// get in touch).
|
|
//
|
|
// Mounted at /api/v1/public by public/index.js.
|
|
|
|
const express = require('express')
|
|
const { body } = require('express-validator')
|
|
|
|
const ctrl = require('./public.controller')
|
|
const validate = require('../../../middleware/validate')
|
|
const { contactLimiter } = require('../../../middleware/rateLimit')
|
|
|
|
const siteRouter = express.Router()
|
|
|
|
siteRouter.get(
|
|
'/settings',
|
|
// #swagger.tags = ['Public']
|
|
// #swagger.summary = 'Public site settings + branding'
|
|
// #swagger.description = 'Whitelisted, non-sensitive settings plus the per-shard brand block (name/colors/logo/hero/favicon) a client themes itself from, and derived registration / game-account-signup availability flags.'
|
|
/* #swagger.responses[200] = { description: 'Public settings + branding', content: { "application/json": { schema: { $ref: "#/components/schemas/PublicSettings" } } } } */
|
|
ctrl.getSettings,
|
|
)
|
|
siteRouter.get(
|
|
'/status',
|
|
// #swagger.tags = ['Public']
|
|
// #swagger.summary = 'Site mode / status'
|
|
// #swagger.description = 'Current site mode (live or maintenance) so the client can show the maintenance page, plus a version block (service id + API/server versions) for a client first-run probe and version-mismatch guard.'
|
|
/* #swagger.responses[200] = { description: 'Site status', content: { "application/json": { schema: { $ref: "#/components/schemas/PublicStatus" } } } } */
|
|
ctrl.getStatus,
|
|
)
|
|
siteRouter.get(
|
|
'/version',
|
|
// #swagger.tags = ['Public']
|
|
// #swagger.summary = 'Backend identity + version'
|
|
// #swagger.description = 'Lightweight, DB-free descriptor of this backend: a stable service id and the API/server versions. A client uses it to recognize a Runic Gateway backend on first-run and to run a version-mismatch guard. Doubles as a cheap liveness check.'
|
|
/* #swagger.responses[200] = { description: 'Backend version', content: { "application/json": { schema: { $ref: "#/components/schemas/PublicVersion" } } } } */
|
|
ctrl.getVersion,
|
|
)
|
|
siteRouter.post(
|
|
'/contact',
|
|
// #swagger.tags = ['Public']
|
|
// #swagger.summary = 'Send a contact message'
|
|
// #swagger.description = 'Emails the site owner (or falls back to a mailto). Rate limited.'
|
|
/* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/ContactRequest" } } } } */
|
|
/* #swagger.responses[200] = { description: 'Message sent', content: { "application/json": { schema: { $ref: "#/components/schemas/Message" } } } } */
|
|
/* #swagger.responses[400] = { description: 'Validation error', content: { "application/json": { schema: { $ref: "#/components/schemas/ValidationError" } } } } */
|
|
/* #swagger.responses[429] = { description: 'Too many messages (rate limited)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
|
/* #swagger.responses[502] = { description: 'Mail delivery failed', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
|
contactLimiter,
|
|
body('message').isString().trim().notEmpty().isLength({ max: 5000 }),
|
|
body('email').optional({ values: 'falsy' }).isEmail(),
|
|
body('name').optional({ values: 'falsy' }).isString().trim().isLength({ max: 100 }),
|
|
validate,
|
|
ctrl.contact,
|
|
)
|
|
|
|
module.exports = siteRouter
|