wtclaude
565a7d2c20
The last split PR of docs/website/API_V2_PLAN.md § Phase 2. public.routes.js,
player.routes.js and auth.routes.js are deleted; each group is now a directory
whose index.js owns the group gate and the mount table and declares no routes.
Every one of the 200 manifest routes is now in a capability router.
public/ posts (2) wiki (4) pages (2) shard (12) site (4, group root)
player/ account (8) shard (8) appeals (4), behind noindex + requireAuth
auth/ login (2) register (1) invite (2) password (3) session (2, root)
No URL moves. All four gates zero-diff: routes.manifest.json (200 public + 2
internal), routes.guards.json, swagger-output.json (198 operations), and
docs/website/api-route-inventory.json was already in sync. 434 tests green.
Notes on the non-mechanical parts:
- public/index.js and auth/index.js carry no group gate, deliberately, and say
so. The public surface is anonymous by contract (logged-out SPA, Discord bot,
Android ShardStreamClient on /public/shard/stream); /auth is where a caller
becomes authenticated. player/index.js gates on requireAuth only, never
requireRole('player') — staff are a superset of players.
- GET /auth/me has a mount-order dependency: use('/me', meRouter) matches the
bare /me, so the request runs meRouter's noindex + requireAuth and falls
through. session.router.js must stay mounted last. Verified by the
counterfactual — mounting it first still 401s but drops X-Robots-Tag, which
no manifest or guards file can see.
- loginGuards moved to auth/loginGuards.js (frozen) rather than being copied
into the three routers that spread it; sso.routes.js drops its duplicate.
- The :param shadowing check was re-run in dispatch order against the built
stack: 86 routes, 64 literal, none shadowed. /public/wiki/{categories,tags}
ahead of /:slug is the only ordering-sensitive pair.
Co-Authored-By: Claude <noreply@anthropic.com>
50 lines
2.2 KiB
JavaScript
50 lines
2.2 KiB
JavaScript
// Point the DB at a closed port BEFORE requiring anything that builds the pool,
|
|
// so any stray DB path fails fast instead of holding the process open. The cases
|
|
// here reject at requireAuth (no session token) before any query runs.
|
|
process.env.DB_HOST = '127.0.0.1'
|
|
process.env.DB_PORT = '59999'
|
|
|
|
const { test, after } = require('node:test')
|
|
const assert = require('node:assert/strict')
|
|
|
|
const { startApp } = require('./_helper')
|
|
const authRouter = require('../src/router/v1/auth')
|
|
const db = require('../src/utils/db')
|
|
|
|
after(() => db.close())
|
|
|
|
// The role-agnostic /auth/me/* self surface must be gated: every route sits behind
|
|
// requireAuth (any role), so an unauthenticated caller gets 401 — never a 404
|
|
// (which would mean the route isn't mounted) and never a 200.
|
|
test('/auth/me/account* rejects unauthenticated callers with 401', async () => {
|
|
const app = await startApp((a) => a.use('/api/v1/auth', authRouter))
|
|
try {
|
|
const calls = [
|
|
['GET', '/api/v1/auth/me/account'],
|
|
['GET', '/api/v1/auth/me/account/identities'],
|
|
['PATCH', '/api/v1/auth/me/account/username', { username: 'someone' }],
|
|
['PATCH', '/api/v1/auth/me/account/password', { newPassword: 'abcd1234' }],
|
|
['POST', '/api/v1/auth/me/account/totp/setup'],
|
|
['POST', '/api/v1/auth/me/account/totp/enable', { code: '123456' }],
|
|
['DELETE', '/api/v1/auth/me/account/identities/google'],
|
|
// Trusted devices + recovery codes are self-service too — same gate.
|
|
['GET', '/api/v1/auth/me/trusted-devices'],
|
|
['POST', '/api/v1/auth/me/trusted-devices', { deviceName: 'X' }],
|
|
['DELETE', '/api/v1/auth/me/trusted-devices'],
|
|
['DELETE', '/api/v1/auth/me/trusted-devices/1'],
|
|
['GET', '/api/v1/auth/me/account/recovery-codes/status'],
|
|
['POST', '/api/v1/auth/me/account/recovery-codes/generate', { currentPassword: 'x' }],
|
|
]
|
|
for (const [method, path, body] of calls) {
|
|
const res = await fetch(app.url + path, {
|
|
method,
|
|
headers: body ? { 'Content-Type': 'application/json' } : {},
|
|
body: body ? JSON.stringify(body) : undefined,
|
|
})
|
|
assert.equal(res.status, 401, `${method} ${path} should be 401, got ${res.status}`)
|
|
}
|
|
} finally {
|
|
await app.close()
|
|
}
|
|
})
|