27e924c7cd
Closes AGENTS.md gotcha #2: getUserFromRequest no longer returns a hardcoded { userId: 1, email: 'admin@tcgvault.com', role: 'admin' } when the Authorization header is missing or malformed. lib/permission-middleware.js - getUserFromRequest now returns null for missing/malformed Bearer headers. No console.warn, no NODE_ENV gate — the fallback is gone, period. - Token-verify path and DB lookup unchanged. pages/api/auth/verify.js - No-token branch now returns 401 instead of fetching the seed admin via `WHERE email = 'admin@tcgvault.com'`. Closes the admin-record- leak side of the same bypass. - JWT-verify branch unchanged. Known follow-up (flagged but NOT addressed in this PR): pages/api/collections/[identifier]/cards.js POST/PUT/DELETE handlers dereference user.userId without a null guard. Previously masked by the synthetic admin (anonymous-write-as-admin on collections owned by user 1 was the security hole). Now degrades to NPE → 500 instead of a clean 401. Security is improved either way; cosmetic 500-vs-401 fix lives in a separate one-line follow-up PR. Convoy: fix-auth-bypass / Brief 2 Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|---|---|---|
| .. | ||
| flags | ||
| admin-auth.js | ||
| ai-ocr.js | ||
| auth-context.js | ||
| auth-secret.js | ||
| database.js | ||
| mana-symbols.js | ||
| permission-middleware.js | ||
| slug-utils.js | ||
| theme-context.js | ||
| use-auth.js | ||