From 6dd78e078aae6e72f2123bce5bd51962a2b57abd Mon Sep 17 00:00:00 2001 From: ScreenTinker Date: Fri, 24 Jul 2026 21:03:25 -0500 Subject: [PATCH] refactor(auth): drop the unused optionalAuth middleware optionalAuth was exported but never mounted on any route (verified by grep across server, frontend, scripts and tests: only its own definition, its export, and one stale comment referenced it). It also carried a second, slightly different copy of the token-resolution logic - its own user column list, and no forced-password-change check - which is exactly the drift the preceding commit consolidates away. Removing it rather than porting it to resolveSessionUser: a "set req.user if a token happens to be present" middleware is a few lines on top of the shared resolver if a route ever needs one, and an unused export is a standing invitation to mount it. Co-Authored-By: Claude Opus 5 (1M context) --- server/lib/tenancy.js | 3 ++- server/middleware/auth.js | 24 +++++------------------- 2 files changed, 7 insertions(+), 20 deletions(-) diff --git a/server/lib/tenancy.js b/server/lib/tenancy.js index 8c6e217..7b618f5 100644 --- a/server/lib/tenancy.js +++ b/server/lib/tenancy.js @@ -82,7 +82,8 @@ function accessContext(userId, role, workspace) { function resolveTenancy(req, res, next) { if (!req.user) { - // Should not happen when chained after requireAuth, but tolerate optionalAuth flows. + // Should not happen when chained after requireAuth; defensive for any future + // caller that runs this resolver without an authenticated user. return next(); } diff --git a/server/middleware/auth.js b/server/middleware/auth.js index 6ea6260..35101c4 100644 --- a/server/middleware/auth.js +++ b/server/middleware/auth.js @@ -150,24 +150,10 @@ function requireAuth(req, res, next) { next(); } -// Optional auth - sets req.user if token present, continues either way -function optionalAuth(req, res, next) { - const authHeader = req.headers.authorization; - if (authHeader && authHeader.startsWith('Bearer ')) { - try { - const token = authHeader.split(' ')[1]; - const decoded = verifyToken(token); - if (decoded.mfa_pending) return next(); // #100: pre-TOTP token is not a session - req.user = decoded.recovery - ? recoveryUser(decoded) - : db.prepare('SELECT id, email, name, role, auth_provider, avatar_url, plan_id FROM users WHERE id = ?').get(decoded.id); - req.jwtWorkspaceId = decoded.current_workspace_id || null; - } catch (err) { - // Token invalid, continue without user - } - } - next(); -} +// (optionalAuth removed: it was exported but never mounted on any route, and it carried +// its own copy of the token-resolution logic - a different user column list, no forced- +// password-change check. A "set req.user if a token happens to be present" middleware is +// reintroducible on top of resolveSessionUser in a few lines if a route ever needs one.) // Phase 2.1: role rename. Phase 1 renamed 'superadmin' to 'platform_admin' and // dropped the in-between 'admin' role. These two guards are widened to accept @@ -226,4 +212,4 @@ function requireSuperAdmin(req, res, next) { // Preferred alias for new code. const requirePlatformAdmin = requireSuperAdmin; -module.exports = { generateToken, generateMfaPendingToken, verifyToken, verifyMfaPendingToken, resolveSessionUser, SessionError, MFA_TOKEN_AUDIENCE, requireAuth, optionalAuth, requireAdmin, requireSuperAdmin, requirePlatformAdmin, isPlatformRole, isPlatformStaff, PLATFORM_ROLES, PLATFORM_STAFF, ELEVATED_ROLES }; +module.exports = { generateToken, generateMfaPendingToken, verifyToken, verifyMfaPendingToken, resolveSessionUser, SessionError, MFA_TOKEN_AUDIENCE, requireAuth, requireAdmin, requireSuperAdmin, requirePlatformAdmin, isPlatformRole, isPlatformStaff, PLATFORM_ROLES, PLATFORM_STAFF, ELEVATED_ROLES };