From 44e887c7cdab25d771cb63d17f560f67d5181e8b Mon Sep 17 00:00:00 2001
From: asepharyana <superaseph@gmail.com>
Date: Wed, 8 Jul 2026 01:59:41 +0700
Subject: [PATCH] fix: keep public upload API unauthenticated

---
 src/index.ts           |  2 +-
 test/bootstrap.test.ts | 31 ++++++++++++++++++++++++++++++-
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index 83ead63..9647305 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -60,7 +60,7 @@ const server = serve({
   port: config.port,
   routes: {
     '/api/upload': {
-      POST: withRateLimit(requireAuth(handleUpload)),
+      POST: withRateLimit(handleUpload),
     },
     '/f/:public_id': {
       GET: withRateLimit(handleFileRedirect),
diff --git a/test/bootstrap.test.ts b/test/bootstrap.test.ts
index 95848c9..08aa332 100644
--- a/test/bootstrap.test.ts
+++ b/test/bootstrap.test.ts
@@ -22,18 +22,30 @@ const mockServe = mock((options: ServeOptions): MockServer => {
 const originalServe = Bun.serve;
 Bun.serve = mockServe as unknown as typeof Bun.serve;
 
+type RouteHandler = (req: Request) => Response | Promise<Response>;
+
 const mockStartBot = mock(() =>
   Promise.resolve({
     stop: mock(),
   }),
 );
+const mockHandleUpload = mock((_req: Request) => Promise.resolve(Response.json({ ok: true })));
+const mockRequireAuth = mock(
+  (_handler: RouteHandler): RouteHandler =>
+    async () =>
+      Response.json({ error: 'Unauthorized' }, { status: 401 }),
+);
 
 mock.module('../src/bot', () => ({
   startBot: mockStartBot,
 }));
 
 mock.module('../src/routes/upload', () => ({
-  handleUpload: mock(),
+  handleUpload: mockHandleUpload,
+}));
+
+mock.module('../src/utils/auth', () => ({
+  requireAuth: mockRequireAuth,
 }));
 
 mock.module('../src/routes/files', () => ({
@@ -62,6 +74,8 @@ describe('Bootstrap Server', () => {
   beforeEach(() => {
     mockServe.mockClear();
     mockStartBot.mockClear();
+    mockHandleUpload.mockClear();
+    mockRequireAuth.mockClear();
   });
 
   afterAll(() => {
@@ -86,5 +100,20 @@ describe('Bootstrap Server', () => {
     expect(serveCallArgs.routes).toHaveProperty('/api/v1/auth/logout');
     expect(serveCallArgs.routes).toHaveProperty('/api/v1/auth/me');
     expect(serveCallArgs.routes).toHaveProperty('/api/v1/*');
+
+    const uploadRoute = serveCallArgs.routes?.['/api/upload'] as { POST: RouteHandler };
+    const res = await uploadRoute.POST(
+      new Request('http://localhost/api/upload', { method: 'POST' }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+    expect(mockHandleUpload).toHaveBeenCalledTimes(1);
+
+    const webApiRoute = serveCallArgs.routes?.['/api/v1/*'] as { GET: RouteHandler };
+    const protectedRes = await webApiRoute.GET(new Request('http://localhost/api/v1/files'));
+
+    expect(protectedRes.status).toBe(401);
+    expect(await protectedRes.json()).toEqual({ error: 'Unauthorized' });
   });
 });