From 6afac59833522dc872bd166c35fb40e31fc999af Mon Sep 17 00:00:00 2001 From: moustillon Date: Tue, 16 Jun 2026 13:53:20 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20enforce=20admin=20auth=20=E2=80=94=20Ely?= =?UTF-8?q?sia=20v1=20plugin=20hooks=20don't=20scope=20to=20parent=20route?= =?UTF-8?q?s?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Le onBeforeHandle défini dans un plugin (.use(adminAuth)) ne s'applique pas aux routes du parent dans Elysia v1. La vérification du token était ignorée, laissant toutes les routes /admin accessibles sans mot de passe. Fix : déplace le onBeforeHandle directement sur adminRoutes avec un Response natif (set.status + return object ne garantit pas le bon status). --- backend/src/middlewares/adminAuth.ts | 11 ++++++----- backend/src/routes/admin.ts | 10 ++++++++-- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/backend/src/middlewares/adminAuth.ts b/backend/src/middlewares/adminAuth.ts index d01e906..a39d468 100644 --- a/backend/src/middlewares/adminAuth.ts +++ b/backend/src/middlewares/adminAuth.ts @@ -1,10 +1,11 @@ import Elysia from "elysia"; export const adminAuth = new Elysia({ name: "adminAuth" }) - .onBeforeHandle(({ headers, set }) => { + .onBeforeHandle(({ headers }) => { const token = headers["authorization"]?.replace("Bearer ", ""); - if (!token || token !== process.env.ADMIN_SECRET) { - set.status = 401; - return { message: "Unauthorized" }; - } + if (!token || token !== process.env.ADMIN_SECRET) + return new Response(JSON.stringify({ message: "Unauthorized" }), { + status: 401, + headers: { "Content-Type": "application/json" }, + }); }); diff --git a/backend/src/routes/admin.ts b/backend/src/routes/admin.ts index f21f2a2..703f930 100644 --- a/backend/src/routes/admin.ts +++ b/backend/src/routes/admin.ts @@ -1,11 +1,17 @@ import Elysia, { t } from "elysia"; -import { adminAuth } from "../middlewares/adminAuth"; import { subjectService } from "../services/subject"; import { eventService } from "../services/event"; import { whitelistModel } from "../models/whitelist"; export const adminRoutes = new Elysia({ prefix: "/admin" }) - .use(adminAuth) + .onBeforeHandle(({ headers }) => { + const token = headers["authorization"]?.replace("Bearer ", ""); + if (!token || token !== process.env.ADMIN_SECRET) + return new Response(JSON.stringify({ message: "Unauthorized" }), { + status: 401, + headers: { "Content-Type": "application/json" }, + }); + }) .post( "/subjects", async ({ body }) => {