fix(cms): restore auth: false on custom REST endpoints

[tataihono]

Summary

Hotfix — PR #646 removed auth: false from custom routes, causing a 404 on /api/language-geo in production. Strapi v5 custom routes without auth: false fall under Users & Permissions, which requires admin-configured roles — not API token auth.

Fix: Created a global api-token-auth middleware that validates the Bearer token against Strapi's hashed API token store. Routes keep auth: false (to bypass U&P) but add the middleware for real auth:

config: {
  auth: false,
  middlewares: ["global::api-token-auth"],
}

Applied to both language-geo and video-coverage endpoints.

How it works

1. Extracts Authorization: Bearer <token> header
2. Hashes the token using Strapi's API token service (apiTokenService.hash)
3. Looks up the hashed token in the admin::api-token table via apiTokenService.getBy
4. Checks expiration
5. Returns 401 if any step fails, calls next() if valid

Files

• NEW: apps/cms/src/middlewares/api-token-auth.ts — global middleware
• MODIFIED: apps/cms/src/api/language-geo/routes/language-geo.ts — adds middleware
• MODIFIED: apps/cms/src/api/video-coverage/routes/video-coverage.ts — adds middleware

Testing

• CMS typechecks clean
• Linting passes

[railway-app]

🚅 Deployed to the forge-pr-647 environment in forge

Service	Status	Web	Updated (UTC)
@forge/cms	✅ Success (View Logs)		Apr 3, 2026 at 8:37 am

2 services not affected by this PR

• @forge/web
• @forge/manager