From c881e6a2b27ad7c982e7359151cde70cd170c16a Mon Sep 17 00:00:00 2001 From: MythEclipse Date: Mon, 15 Jun 2026 20:11:11 +0700 Subject: [PATCH] fix(auth): pass request.headers to getCurrentUser in all protected routes dashboard, diagnoses, expert routes now support Authorization header fallback for Android WebView Co-Authored-By: Claude --- apps/api/src/routes/dashboard.ts | 2 +- apps/api/src/routes/diagnoses.ts | 6 +++--- apps/api/src/routes/expert.ts | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/apps/api/src/routes/dashboard.ts b/apps/api/src/routes/dashboard.ts index e0a3aa8..6223b07 100644 --- a/apps/api/src/routes/dashboard.ts +++ b/apps/api/src/routes/dashboard.ts @@ -13,7 +13,7 @@ export const dashboardRoutes = new Elysia({ prefix: '/api/v1' }) .get('/dashboard/summary', async ({ request }) => { try { const db = createDbClient(); - const user = await getCurrentUser(request.headers.get('cookie')); + const user = await getCurrentUser(request.headers.get('cookie'), request.headers); const diseases = await db.select().from(diseaseCatalog).orderBy(diseaseCatalog.displayOrder); const manualRows = await db.select().from(manualClassifications).orderBy(desc(manualClassifications.createdAt)).limit(1); diff --git a/apps/api/src/routes/diagnoses.ts b/apps/api/src/routes/diagnoses.ts index b839f6b..483b692 100644 --- a/apps/api/src/routes/diagnoses.ts +++ b/apps/api/src/routes/diagnoses.ts @@ -175,7 +175,7 @@ function getFileFromBody(body: unknown): File | null { export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' }) .post('/diagnoses', async ({ body, request }) => { - const user = await getCurrentUser(request.headers.get('cookie')); + const user = await getCurrentUser(request.headers.get('cookie'), request.headers); if (!user) return unauthorized('Authentication required'); const file = getFileFromBody(body); @@ -251,7 +251,7 @@ export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' }) } }) .get('/diagnoses', async ({ request }) => { - const user = await getCurrentUser(request.headers.get('cookie')); + const user = await getCurrentUser(request.headers.get('cookie'), request.headers); if (!user) return unauthorized('Authentication required'); try { @@ -270,7 +270,7 @@ export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' }) } }) .get('/diagnoses/:id', async ({ params, request }) => { - const user = await getCurrentUser(request.headers.get('cookie')); + const user = await getCurrentUser(request.headers.get('cookie'), request.headers); if (!user) return unauthorized('Authentication required'); try { diff --git a/apps/api/src/routes/expert.ts b/apps/api/src/routes/expert.ts index 632a7cd..1aa19e8 100644 --- a/apps/api/src/routes/expert.ts +++ b/apps/api/src/routes/expert.ts @@ -16,7 +16,7 @@ function isDiagnosisRecordOrNull(record: unknown): record is DiagnosisRecord { export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' }) .get('/reviews', async ({ request }) => { - const user = await getCurrentUser(request.headers.get('cookie')); + const user = await getCurrentUser(request.headers.get('cookie'), request.headers); if (!user) return unauthorized('Authentication required'); if (user.role !== 'expert') return forbidden('Expert role required'); @@ -36,7 +36,7 @@ export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' }) } }) .post('/reviews/:diagnosisId', async ({ params, body, request }) => { - const user = await getCurrentUser(request.headers.get('cookie')); + const user = await getCurrentUser(request.headers.get('cookie'), request.headers); if (!user) return unauthorized('Authentication required'); if (user.role !== 'expert') return forbidden('Expert role required');