Authorization middleware #10

New issue

Closed

opened 2026-06-12 20:27:21 +00:00 by james · 0 comments

james commented

2026-06-12 20:27:21 +00:00

Owner

Centralize the rule: every endpoint except /api/health and the auth callbacks requires a valid session.

Scope

A Next.js middleware (or equivalent route guard) that:
- Allows /api/health and the auth callback routes through unauthenticated.
- Rejects every other request without a valid session with a 401.
Tests assert the policy: an unauthenticated request to a random /api/* route returns 401.
The default for any new route is "requires auth" — adding a public route must be an explicit opt-in, not a default.

Acceptance criteria

Unauthenticated /api/anything-else returns 401.
Unauthenticated /api/health returns 200.
Adding a public route requires an explicit allowlist entry; this is documented.

Part of epic #1. Depends on #7.

Centralize the rule: every endpoint except `/api/health` and the auth callbacks requires a valid session. ## Scope - A Next.js middleware (or equivalent route guard) that: - Allows `/api/health` and the auth callback routes through unauthenticated. - Rejects every other request without a valid session with a 401. - Tests assert the policy: an unauthenticated request to a random `/api/*` route returns 401. - The default for **any new route** is "requires auth" — adding a public route must be an explicit opt-in, not a default. ## Acceptance criteria - [ ] Unauthenticated `/api/anything-else` returns 401. - [ ] Unauthenticated `/api/health` returns 200. - [ ] Adding a public route requires an explicit allowlist entry; this is documented. Part of epic #1. Depends on #7.

james referenced this issue

2026-06-12 20:27:26 +00:00

Local user authentication #11

james referenced this issue

2026-06-12 20:28:14 +00:00

Profile feature #21

james referenced this issue

2026-06-12 20:28:18 +00:00

Skills feature #22

james referenced this issue

2026-06-12 20:28:22 +00:00

Education feature #23