From dae2709d317632d65da290cb33b2ce2818df2c13 Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Thu, 19 Feb 2026 23:55:43 +0530 Subject: [PATCH 1/8] Fix: Authentication Middleware in StatusPage --- server/src/routes/statusPageRoute.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/routes/statusPageRoute.ts b/server/src/routes/statusPageRoute.ts index 1468f9d16..81d77fd19 100755 --- a/server/src/routes/statusPageRoute.ts +++ b/server/src/routes/statusPageRoute.ts @@ -18,7 +18,7 @@ class StatusPageRoutes { this.router.post("/", upload.single("logo"), verifyJWT, this.statusPageController.createStatusPage); this.router.put("/:id", upload.single("logo"), verifyJWT, this.statusPageController.updateStatusPage); - this.router.get("/:url", this.statusPageController.getStatusPageByUrl); + this.router.get("/:url", verifyJWT, this.statusPageController.getStatusPageByUrl); this.router.delete("/:id", verifyJWT, this.statusPageController.deleteStatusPage); } From b87fd5438eaaebd9e1f1a116122bcd72efb4d2d8 Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Fri, 20 Feb 2026 00:30:06 +0530 Subject: [PATCH 2/8] feat: verifyStatusPage middleware --- .../src/middleware/verifyStatusPageAccess.ts | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 server/src/middleware/verifyStatusPageAccess.ts diff --git a/server/src/middleware/verifyStatusPageAccess.ts b/server/src/middleware/verifyStatusPageAccess.ts new file mode 100644 index 000000000..4b1627b0a --- /dev/null +++ b/server/src/middleware/verifyStatusPageAccess.ts @@ -0,0 +1,18 @@ +import { NextFunction, Request, Response } from "express"; +import { IStatusPagesRepository } from "@/repositories/index.js"; + +export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPagesRepository) => { + return async (req: Request, res: Response, next: NextFunction) => { + try { + const url = req.params.url; + const statusPage = await statusPagesRepository.findByUrl(url); + if (statusPage.isPublished) { + next(); // Published — proceed to controller (no JWT) + } else { + next("route"); // Unpublished — skip to next route (which has verifyJWT) + } + } catch (error) { + next(error); + } + }; +}; From 600c937062a820fd46c1b20c3bc052434287bf9c Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Fri, 20 Feb 2026 00:31:42 +0530 Subject: [PATCH 3/8] feat: API Middleware --- server/src/routes/statusPageRoute.ts | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/server/src/routes/statusPageRoute.ts b/server/src/routes/statusPageRoute.ts index 81d77fd19..ca917af2a 100755 --- a/server/src/routes/statusPageRoute.ts +++ b/server/src/routes/statusPageRoute.ts @@ -6,18 +6,21 @@ class StatusPageRoutes { private router: Router; private statusPageController: any; - constructor(statusPageController: any, verifyJWT: RequestHandler) { + constructor(statusPageController: any, verifyJWT: RequestHandler, verifyStatusPageAccess: RequestHandler) { this.router = Router(); this.statusPageController = statusPageController; - this.initRoutes(verifyJWT); + this.initRoutes(verifyJWT, verifyStatusPageAccess); } - initRoutes(verifyJWT: RequestHandler) { + initRoutes(verifyJWT: RequestHandler, verifyStatusPageAccess: RequestHandler) { this.router.get("/team", verifyJWT, this.statusPageController.getStatusPagesByTeamId); this.router.post("/", upload.single("logo"), verifyJWT, this.statusPageController.createStatusPage); this.router.put("/:id", upload.single("logo"), verifyJWT, this.statusPageController.updateStatusPage); + // Route 1: published pages — no JWT + this.router.get("/:url", verifyStatusPageAccess, this.statusPageController.getStatusPageByUrl); + // Route 2: unpublished pages — JWT required (reached via next("route")) this.router.get("/:url", verifyJWT, this.statusPageController.getStatusPageByUrl); this.router.delete("/:id", verifyJWT, this.statusPageController.deleteStatusPage); } From 0974c84b8d9143464410f361e2069c5c0c97d43e Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Fri, 20 Feb 2026 00:34:23 +0530 Subject: [PATCH 4/8] feat: fe integration of new endpoint --- client/src/Utils/ApiClient.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/client/src/Utils/ApiClient.ts b/client/src/Utils/ApiClient.ts index b18f2dfbc..0fef9b4a0 100644 --- a/client/src/Utils/ApiClient.ts +++ b/client/src/Utils/ApiClient.ts @@ -61,7 +61,10 @@ export const initApiClient = (store: StoreType): void => { } if (error.response?.status === 401) { - if (window.location.pathname !== "/login") { + if ( + window.location.pathname !== "/login" && + !window.location.pathname.startsWith("/status/public") + ) { window.location.href = "/login"; } } From 1a52531fafb501a5fdd2a5e0083afa1709a18177 Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Fri, 20 Feb 2026 00:34:43 +0530 Subject: [PATCH 5/8] feat: new middleware --- server/src/config/routes.ts | 4 +++- server/src/controllers/statusPageController.ts | 8 ++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/server/src/config/routes.ts b/server/src/config/routes.ts index d38ac69ae..ba9158cd5 100644 --- a/server/src/config/routes.ts +++ b/server/src/config/routes.ts @@ -1,4 +1,5 @@ import { createVerifyJWT } from "../middleware/verifyJWT.js"; +import { createVerifyStatusPageAccess } from "../middleware/verifyStatusPageAccess.js"; import { authApiLimiter } from "../middleware/rateLimiter.js"; import AuthRoutes from "../routes/authRoute.js"; @@ -25,7 +26,8 @@ export const setupRoutes = (app: any, controllers: Record, services const maintenanceWindowRoutes = new MaintenanceWindowRoutes(controllers.maintenanceWindowController); const queueRoutes = new QueueRoutes(controllers.queueController); const logRoutes = new LogRoutes(controllers.logController); - const statusPageRoutes = new StatusPageRoutes(controllers.statusPageController, verifyJWT); + const verifyStatusPageAccess = createVerifyStatusPageAccess(services.statusPagesRepository); + const statusPageRoutes = new StatusPageRoutes(controllers.statusPageController, verifyJWT, verifyStatusPageAccess); const notificationRoutes = new NotificationRoutes(controllers.notificationController); const diagnosticRoutes = new DiagnosticRoutes(controllers.diagnosticController, verifyJWT); const incidentRoutes = new IncidentRoutes(controllers.incidentController); diff --git a/server/src/controllers/statusPageController.ts b/server/src/controllers/statusPageController.ts index f9cca161e..b936ff5ad 100644 --- a/server/src/controllers/statusPageController.ts +++ b/server/src/controllers/statusPageController.ts @@ -78,6 +78,14 @@ class StatusPageController { } const statusPage = await this.statusPageService.getStatusPageByUrl(req.params.url as string); + + if (!statusPage.isPublished) { + const teamId = requireTeamId(req?.user?.teamId); + if (statusPage.teamId !== teamId) { + throw new AppError({ message: "Forbidden", status: 403 }); + } + } + const settings = await this.settingsService.getDBSettings(); const showURL = settings.showURL; From c27bb0e7f15c40188d8c82e9eb3d094c3f8d175d Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Fri, 20 Feb 2026 00:52:36 +0530 Subject: [PATCH 6/8] fix: build error --- server/src/middleware/verifyStatusPageAccess.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/server/src/middleware/verifyStatusPageAccess.ts b/server/src/middleware/verifyStatusPageAccess.ts index 4b1627b0a..6dbf9ba72 100644 --- a/server/src/middleware/verifyStatusPageAccess.ts +++ b/server/src/middleware/verifyStatusPageAccess.ts @@ -1,10 +1,14 @@ import { NextFunction, Request, Response } from "express"; import { IStatusPagesRepository } from "@/repositories/index.js"; +import { AppError } from "@/utils/AppError.js"; export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPagesRepository) => { return async (req: Request, res: Response, next: NextFunction) => { try { const url = req.params.url; + if (!url) { + throw new AppError({ message: "Status page URL is required", status: 400 }); + } const statusPage = await statusPagesRepository.findByUrl(url); if (statusPage.isPublished) { next(); // Published — proceed to controller (no JWT) From f9653888b1fbd93afdf3a8dee18453040de7ce97 Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Sat, 21 Feb 2026 00:10:39 +0530 Subject: [PATCH 7/8] Fix: One Route --- server/src/config/routes.ts | 2 +- server/src/middleware/verifyStatusPageAccess.ts | 8 ++++---- server/src/routes/statusPageRoute.ts | 3 --- 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/server/src/config/routes.ts b/server/src/config/routes.ts index ba9158cd5..8707009a8 100644 --- a/server/src/config/routes.ts +++ b/server/src/config/routes.ts @@ -26,7 +26,7 @@ export const setupRoutes = (app: any, controllers: Record, services const maintenanceWindowRoutes = new MaintenanceWindowRoutes(controllers.maintenanceWindowController); const queueRoutes = new QueueRoutes(controllers.queueController); const logRoutes = new LogRoutes(controllers.logController); - const verifyStatusPageAccess = createVerifyStatusPageAccess(services.statusPagesRepository); + const verifyStatusPageAccess = createVerifyStatusPageAccess(services.statusPagesRepository, verifyJWT); const statusPageRoutes = new StatusPageRoutes(controllers.statusPageController, verifyJWT, verifyStatusPageAccess); const notificationRoutes = new NotificationRoutes(controllers.notificationController); const diagnosticRoutes = new DiagnosticRoutes(controllers.diagnosticController, verifyJWT); diff --git a/server/src/middleware/verifyStatusPageAccess.ts b/server/src/middleware/verifyStatusPageAccess.ts index 6dbf9ba72..7f8d8baba 100644 --- a/server/src/middleware/verifyStatusPageAccess.ts +++ b/server/src/middleware/verifyStatusPageAccess.ts @@ -1,8 +1,8 @@ -import { NextFunction, Request, Response } from "express"; +import { NextFunction, Request, RequestHandler, Response } from "express"; import { IStatusPagesRepository } from "@/repositories/index.js"; import { AppError } from "@/utils/AppError.js"; -export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPagesRepository) => { +export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPagesRepository, verifyJWT: RequestHandler) => { return async (req: Request, res: Response, next: NextFunction) => { try { const url = req.params.url; @@ -11,9 +11,9 @@ export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPages } const statusPage = await statusPagesRepository.findByUrl(url); if (statusPage.isPublished) { - next(); // Published — proceed to controller (no JWT) + next(); // Published — no auth needed } else { - next("route"); // Unpublished — skip to next route (which has verifyJWT) + verifyJWT(req, res, next); // Unpublished — require JWT } } catch (error) { next(error); diff --git a/server/src/routes/statusPageRoute.ts b/server/src/routes/statusPageRoute.ts index ca917af2a..a53aa04d9 100755 --- a/server/src/routes/statusPageRoute.ts +++ b/server/src/routes/statusPageRoute.ts @@ -18,10 +18,7 @@ class StatusPageRoutes { this.router.post("/", upload.single("logo"), verifyJWT, this.statusPageController.createStatusPage); this.router.put("/:id", upload.single("logo"), verifyJWT, this.statusPageController.updateStatusPage); - // Route 1: published pages — no JWT this.router.get("/:url", verifyStatusPageAccess, this.statusPageController.getStatusPageByUrl); - // Route 2: unpublished pages — JWT required (reached via next("route")) - this.router.get("/:url", verifyJWT, this.statusPageController.getStatusPageByUrl); this.router.delete("/:id", verifyJWT, this.statusPageController.deleteStatusPage); } From e25669ac6a64cd133bc05bcc23570a38139027f7 Mon Sep 17 00:00:00 2001 From: Br0wnHammer Date: Sat, 21 Feb 2026 00:12:17 +0530 Subject: [PATCH 8/8] Fix: Client Redirect --- client/src/Utils/ApiClient.ts | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/client/src/Utils/ApiClient.ts b/client/src/Utils/ApiClient.ts index 0fef9b4a0..b18f2dfbc 100644 --- a/client/src/Utils/ApiClient.ts +++ b/client/src/Utils/ApiClient.ts @@ -61,10 +61,7 @@ export const initApiClient = (store: StoreType): void => { } if (error.response?.status === 401) { - if ( - window.location.pathname !== "/login" && - !window.location.pathname.startsWith("/status/public") - ) { + if (window.location.pathname !== "/login") { window.location.href = "/login"; } }