diff --git a/server/src/config/routes.ts b/server/src/config/routes.ts index ba9158cd5..8707009a8 100644 --- a/server/src/config/routes.ts +++ b/server/src/config/routes.ts @@ -26,7 +26,7 @@ export const setupRoutes = (app: any, controllers: Record, services const maintenanceWindowRoutes = new MaintenanceWindowRoutes(controllers.maintenanceWindowController); const queueRoutes = new QueueRoutes(controllers.queueController); const logRoutes = new LogRoutes(controllers.logController); - const verifyStatusPageAccess = createVerifyStatusPageAccess(services.statusPagesRepository); + const verifyStatusPageAccess = createVerifyStatusPageAccess(services.statusPagesRepository, verifyJWT); const statusPageRoutes = new StatusPageRoutes(controllers.statusPageController, verifyJWT, verifyStatusPageAccess); const notificationRoutes = new NotificationRoutes(controllers.notificationController); const diagnosticRoutes = new DiagnosticRoutes(controllers.diagnosticController, verifyJWT); diff --git a/server/src/middleware/verifyStatusPageAccess.ts b/server/src/middleware/verifyStatusPageAccess.ts index 6dbf9ba72..7f8d8baba 100644 --- a/server/src/middleware/verifyStatusPageAccess.ts +++ b/server/src/middleware/verifyStatusPageAccess.ts @@ -1,8 +1,8 @@ -import { NextFunction, Request, Response } from "express"; +import { NextFunction, Request, RequestHandler, Response } from "express"; import { IStatusPagesRepository } from "@/repositories/index.js"; import { AppError } from "@/utils/AppError.js"; -export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPagesRepository) => { +export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPagesRepository, verifyJWT: RequestHandler) => { return async (req: Request, res: Response, next: NextFunction) => { try { const url = req.params.url; @@ -11,9 +11,9 @@ export const createVerifyStatusPageAccess = (statusPagesRepository: IStatusPages } const statusPage = await statusPagesRepository.findByUrl(url); if (statusPage.isPublished) { - next(); // Published — proceed to controller (no JWT) + next(); // Published — no auth needed } else { - next("route"); // Unpublished — skip to next route (which has verifyJWT) + verifyJWT(req, res, next); // Unpublished — require JWT } } catch (error) { next(error); diff --git a/server/src/routes/statusPageRoute.ts b/server/src/routes/statusPageRoute.ts index ca917af2a..a53aa04d9 100755 --- a/server/src/routes/statusPageRoute.ts +++ b/server/src/routes/statusPageRoute.ts @@ -18,10 +18,7 @@ class StatusPageRoutes { this.router.post("/", upload.single("logo"), verifyJWT, this.statusPageController.createStatusPage); this.router.put("/:id", upload.single("logo"), verifyJWT, this.statusPageController.updateStatusPage); - // Route 1: published pages — no JWT this.router.get("/:url", verifyStatusPageAccess, this.statusPageController.getStatusPageByUrl); - // Route 2: unpublished pages — JWT required (reached via next("route")) - this.router.get("/:url", verifyJWT, this.statusPageController.getStatusPageByUrl); this.router.delete("/:id", verifyJWT, this.statusPageController.deleteStatusPage); }