web-cad/backend/test_report.md

Test Report — Auth Middleware & CORS Fix (Issue #1 + #3)

Date: 2026-06-29 Task: Fix Issue #1 (No Authentication on CRUD Routes) + Issue #3 (CORS) from CODE_ANALYSIS.md File modified: backend/src/server.ts

Build Verification

cd /a0/usr/workdir/web-cad-neu/backend && npx tsc --noEmit

Result: ✅ PASS — No type errors, exit code 0

Test Results

Test 1: Unauthenticated /api/projects → 401

curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/api/projects

Expected: 401 Actual: 401 ✅

Test 2: Health check /api/health → 200

curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/api/health

Expected: 200 Actual: 200 ✅

Test 3: Register endpoint accessible (no auth required)

curl -s -X POST http://localhost:3001/api/auth/register -H 'Content-Type: application/json' \
  -d '{"email":"test@test.de","password":"test1234","name":"Test User"}'

Expected: 201 Actual: 201 ✅ (user created, session token returned)

Test 4: Login endpoint accessible (no auth required)

curl -s -w '\nHTTP_CODE:%{http_code}' -X POST http://localhost:3001/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"test@test.de","password":"test1234"}'

Expected: 200 Actual: 200 ✅ (user + session token returned)

Test 5: Authenticated /api/projects → 200

TOKEN=<valid_session_token>
curl -s -w '\nHTTP_CODE:%{http_code}' http://localhost:3001/api/projects \
  -H "Authorization: Bearer $TOKEN"

Expected: 200 Actual: 200 ✅ (project list returned)

Smoke Test

• Backend starts without errors: ✅
• Server listens on port 3001: ✅
• Yjs persistence initialized: ✅
• Auth middleware correctly blocks unauthenticated /api/ requests: ✅
• Auth middleware correctly skips /api/auth/login, /api/auth/register, /api/health: ✅
• Auth middleware correctly skips non-/api/ routes (static files): ✅
• Valid Bearer token grants access to protected routes: ✅
• CORS restricted to allowed origins (web-cad-neu.server.media-on.de, localhost:5173, localhost:8082): ✅

Changes Summary

server.ts — Auth Middleware (Issue #1)

Added onRequest hook after authService creation, before route registrations:

• Skips /api/auth/login, /api/auth/register, /api/health
• Skips all non-/api/ routes (static files, WebSocket)
• Extracts Bearer token from Authorization header
• Validates via authService.getUserFromSession(token)
• Returns 401 if no token or invalid session
• Attaches user to (request as any).user for route handlers

server.ts — CORS Fix (Issue #3)

Changed origin: true to restrictive config:

• Allows requests with no origin (same-origin, curl)
• Allows known origins: https://web-cad-neu.server.media-on.de, http://localhost:5173, http://localhost:8082
• Rejects all other origins

Known Issues

• None