feat: wire role-based auth middleware into all write endpoints#65
Merged
feat: wire role-based auth middleware into all write endpoints#65
Conversation
Add tests for GET /lot (list by farm_id), GET /lot/:id/provenance (redirect), and GET /provenance/:lotId (HTML page). All 29 backend endpoints now have integration test coverage. 105 tests passing. Serves goal #13 — 100% unit test coverage by April 15th. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Cover zero USD→sats, Infinity, NaN, null, cache consistency, export format case-insensitivity, default format, Content-Disposition, and invalid format rejection. Also expose response headers in test helper. 115 tests passing (was 105). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Set up Jest + ts-jest for the mobile app (previously had 0 tests). Covers all api.ts endpoints: health, farms, workers, shifts, lots, payroll, provenance, plus error handling and header verification. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The requireAuth middleware existed but was not applied to any routes.
Now all POST/PUT endpoints enforce role-based API key auth:
- admin: POST /farm, POST /payroll, PUT /worker/:id/pay-rate
- foreman: POST /shift, POST /shift/:id/close, POST /worker,
PUT /worker/:id, POST /lot, POST /lot/:id/transfer
- worker: POST /shift/:id/checkin
Auth is still skipped in dev/test mode (no keys configured).
All 115 tests continue to pass.
Closes #12
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
requireAuthmiddleware (frommiddleware/auth.js) into all POST/PUT routes across 5 route filesPOST /farm,POST /payroll,PUT /worker/:id/pay-ratePOST /shift,POST /shift/:id/close,POST /worker,PUT /worker/:id,POST /lot,POST /lot/:id/transferPOST /shift/:id/checkinTest plan
ADMIN_KEY=test123env var: confirmPOST /payrollreturns 401 without header, 200 withBearer test123Serves goal #12: API authentication
🤖 Generated with Claude Code