Auth middleware completely disabled — zero auth protection #17
Labels
No labels
blocked:needs-attention
blocked:needs-decision
bug
chore
in-progress
quickfix
security/high
triage-approved
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
AuWoMe/forgeflow#17
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
middleware.ts always uses noOpHandler, bypassing Clerk auth. All routes unprotected.
Overseer closeout (phase: Implement, state: stuck → resolved): the fix for this issue was already implemented and committed as
e78d00d("fix: enforce Clerk auth in middleware unconditionally (refs #17)"), which is an ancestor of HEAD and present on origin/main. Verified in the current tree: src/middleware.ts has no NO_AUTH short-circuit and always invokes clerkMiddlewareHandler with auth().protect() on /app/* routes; src/middleware.test.ts has 5 passing tests (incl. no-short-circuit with NO_AUTH=true); npm run typecheck exits 0; npm run lint exits 0 (only pre-existing warnings in unrelated files). The implement phase correctly concluded no new commit was needed; the runner flagged stuck on idle. Closing as done.