Migrate auth to shared middleware layer
+291 / −56 lines
8 files changed
Commit message: "fix auth stuff"
No agent brief available. This PR was written by a human with a single commit message: "fix auth stuff". The AI analyzed the diff shape and reconstructed 4 likely decisions. Verify each is accurate — correcting wrong inferences is faster than explaining decisions from scratch.
Verified: 0 / 4
Inferred · Architecture
Auth was consolidated from per-route to middleware layer
92% confidence
Detected:
If this is accurate: any route not in the public allowlist is now protected by default. New routes are secure unless explicitly excluded.
authMiddleware newly registered on app + simultaneous removal of requireAuth from 23 route definitions. This pattern indicates middleware consolidation.
If this is accurate: any route not in the public allowlist is now protected by default. New routes are secure unless explicitly excluded.
Inferred · Config
Public routes defined via explicit allowlist
88% confidence
Detected: new
Question this raises: is
PUBLIC_ROUTES array exported from config/routes.ts, imported and checked inside the middleware. This is an allowlist pattern — routes not in this array require auth.
Question this raises: is
/health, /docs, and /auth/register the complete list of public routes? Are there any that were missed?
Inferred · Cleanup
23 @requireAuth decorators removed across route files
99% confidence
Detected: identical deletion pattern across 6 route files —
Question this raises: were all 23 removals checked against the
requireAuth removed from every handler. High-confidence mechanical cleanup. @adminOnly and @roleRequired decorators appear to be intentionally preserved.
Question this raises: were all 23 removals checked against the
PUBLIC_ROUTES allowlist to verify nothing became accidentally public?
Inferred · Infrastructure
Session storage changed from in-memory Map to Redis
64% confidence · Needs verification
Detected:
This needs explicit verification: was this change planned? Is Redis deployed in this environment? What happens if Redis is unavailable at startup?
Map<string, Session> replaced with Redis client in lib/session.ts. This may be intentional infrastructure improvement or could be an unplanned change bundled into this PR. Lower confidence because the commit message ("fix auth stuff") provides no signal.
This needs explicit verification: was this change planned? Is Redis deployed in this environment? What happens if Redis is unavailable at startup?