From ffea9bb0ba0393de615c86ca7d6be369ec3dccaf Mon Sep 17 00:00:00 2001 From: asepharyana Date: Thu, 2 Jul 2026 06:51:57 +0700 Subject: [PATCH] fix(backend): only require auth for voice/media routes, rest public Messages, analysis, mascot-chat, recordings, ui-state, and guilds endpoints are now accessible without authentication. Only voice (connect/disconnect/transmit) and media (queue/skip/stop/volume) remain behind the admin password guard. --- services/backend/src/http/app.ts | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/services/backend/src/http/app.ts b/services/backend/src/http/app.ts index 32f10b6..3caa32f 100644 --- a/services/backend/src/http/app.ts +++ b/services/backend/src/http/app.ts @@ -73,19 +73,18 @@ export function createHttpApp(): Express { // Public read-only endpoints app.use("/api", createConfigRouter()); app.use("/api", createDashboardRouter()); + app.use("/api", createMessagesRouter()); + app.use("/api", createAnalysisRouter()); + app.use("/api", createMascotChatRouter()); + app.use("/api", createRecordingsRouter()); + app.use("/api", createUiStateRouter()); + app.use("/api/guilds", createGuildsRouter()); // Protected routes — require admin authentication (X-Admin-Password header) + // Only voice and media control endpoints need auth const adminAuthMiddleware = adminAuth(ADMIN_PASSWORD); - app.use("/api", adminAuthMiddleware, createMessagesRouter()); - app.use("/api", adminAuthMiddleware, createAnalysisRouter()); - app.use("/api", adminAuthMiddleware, createMascotChatRouter()); app.use("/api", adminAuthMiddleware, createMediaRouter()); app.use("/api", adminAuthMiddleware, createVoiceRouter()); - app.use("/api", adminAuthMiddleware, createRecordingsRouter()); - app.use("/api", adminAuthMiddleware, createUiStateRouter()); - - // Guilds routes - app.use("/api/guilds", adminAuthMiddleware, createGuildsRouter()); // 404 handler app.use((_req: Request, res: Response) => {