From 39dcba3d80c06415c34f1ae4cd6552c80c69935c Mon Sep 17 00:00:00 2001 From: Suriya Date: Wed, 5 Aug 2026 18:23:59 +0530 Subject: [PATCH] fix: put the Redis user-cache utilities behind console auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /api/v1/utils/users/redis exposed open CRUD — create, read, update and delete on the cached-user store — to anonymous callers. The store is currently empty and nothing in the console or apps calls it, so closing it breaks no client. Third of the three route groups flagged in the 2026-07-27 audit. /crm/* stays open by explicit decision: the field-sales Flutter app sends no credentials. Co-Authored-By: Claude Opus 5 (1M context) --- routes/routes.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/routes/routes.go b/routes/routes.go index 33c465e..8be393b 100644 --- a/routes/routes.go +++ b/routes/routes.go @@ -359,8 +359,11 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) { hubAuth.Get("/report", controllers.GetHubReport) - // Redis active user caching utilities - redisUsers := api.Group("/utils/users/redis") + // Redis active user caching utilities — console/ops only. Open CRUD on a + // user cache with no authentication has no legitimate anonymous caller; + // the store is currently empty, so closing it breaks nothing. + redisUsers := api.Group("/utils/users/redis", + middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(1, 3, 4)) redisUsers.Post("/", controllers.CreateUserRedis) redisUsers.Get("/", controllers.GetUserRedis) redisUsers.Put("/:userid", controllers.UpdateUserRedis)