Leopoldadmin
86 lines
2.8 KiB
Markdown
86 lines
2.8 KiB
Markdown
# Test Report — Auth Middleware & CORS Fix (Issue #1 + #3)
|
|
|
|
**Date:** 2026-06-29
|
|
**Task:** Fix Issue #1 (No Authentication on CRUD Routes) + Issue #3 (CORS) from CODE_ANALYSIS.md
|
|
**File modified:** `backend/src/server.ts`
|
|
|
|
## Build Verification
|
|
|
|
```
|
|
cd /a0/usr/workdir/web-cad-neu/backend && npx tsc --noEmit
|
|
```
|
|
**Result:** ✅ PASS — No type errors, exit code 0
|
|
|
|
## Test Results
|
|
|
|
### Test 1: Unauthenticated /api/projects → 401
|
|
```
|
|
curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/api/projects
|
|
```
|
|
**Expected:** 401
|
|
**Actual:** 401 ✅
|
|
|
|
### Test 2: Health check /api/health → 200
|
|
```
|
|
curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/api/health
|
|
```
|
|
**Expected:** 200
|
|
**Actual:** 200 ✅
|
|
|
|
### Test 3: Register endpoint accessible (no auth required)
|
|
```
|
|
curl -s -X POST http://localhost:3001/api/auth/register -H 'Content-Type: application/json' \
|
|
-d '{"email":"test@test.de","password":"test1234","name":"Test User"}'
|
|
```
|
|
**Expected:** 201
|
|
**Actual:** 201 ✅ (user created, session token returned)
|
|
|
|
### Test 4: Login endpoint accessible (no auth required)
|
|
```
|
|
curl -s -w '\nHTTP_CODE:%{http_code}' -X POST http://localhost:3001/api/auth/login \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{"email":"test@test.de","password":"test1234"}'
|
|
```
|
|
**Expected:** 200
|
|
**Actual:** 200 ✅ (user + session token returned)
|
|
|
|
### Test 5: Authenticated /api/projects → 200
|
|
```
|
|
TOKEN=<valid_session_token>
|
|
curl -s -w '\nHTTP_CODE:%{http_code}' http://localhost:3001/api/projects \
|
|
-H "Authorization: Bearer $TOKEN"
|
|
```
|
|
**Expected:** 200
|
|
**Actual:** 200 ✅ (project list returned)
|
|
|
|
## Smoke Test
|
|
|
|
- Backend starts without errors: ✅
|
|
- Server listens on port 3001: ✅
|
|
- Yjs persistence initialized: ✅
|
|
- Auth middleware correctly blocks unauthenticated /api/ requests: ✅
|
|
- Auth middleware correctly skips /api/auth/login, /api/auth/register, /api/health: ✅
|
|
- Auth middleware correctly skips non-/api/ routes (static files): ✅
|
|
- Valid Bearer token grants access to protected routes: ✅
|
|
- CORS restricted to allowed origins (web-cad-neu.server.media-on.de, localhost:5173, localhost:8082): ✅
|
|
|
|
## Changes Summary
|
|
|
|
### server.ts — Auth Middleware (Issue #1)
|
|
Added `onRequest` hook after `authService` creation, before route registrations:
|
|
- Skips `/api/auth/login`, `/api/auth/register`, `/api/health`
|
|
- Skips all non-`/api/` routes (static files, WebSocket)
|
|
- Extracts Bearer token from Authorization header
|
|
- Validates via `authService.getUserFromSession(token)`
|
|
- Returns 401 if no token or invalid session
|
|
- Attaches user to `(request as any).user` for route handlers
|
|
|
|
### server.ts — CORS Fix (Issue #3)
|
|
Changed `origin: true` to restrictive config:
|
|
- Allows requests with no origin (same-origin, curl)
|
|
- Allows known origins: `https://web-cad-neu.server.media-on.de`, `http://localhost:5173`, `http://localhost:8082`
|
|
- Rejects all other origins
|
|
|
|
## Known Issues
|
|
- None
|