From 4d03676e60d4d540c130c207852aea3f039a42cc Mon Sep 17 00:00:00 2001 From: Suriya Date: Wed, 5 Aug 2026 18:22:42 +0530 Subject: [PATCH] fix: put the booking cache endpoints behind console auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /api/v1/bookings/cache/* was open "for testing" but is live in production: listing it returns real bookings including customer delivery addresses, and /customer/:customer_id takes the customer straight from the URL, so anyone could enumerate a given customer's bookings without credentials. Now requires a console token (roles 1/3/4), matching the rest of the admin surface. The /crm/* group stays open by deliberate decision — the field-sales Flutter app authenticates with nothing and would break; revisit when that app can send a key. Co-Authored-By: Claude Opus 5 (1M context) --- routes/routes.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/routes/routes.go b/routes/routes.go index 95ac9d8..33c465e 100644 --- a/routes/routes.go +++ b/routes/routes.go @@ -373,9 +373,13 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) { api.Post("/pricing/check", controllers.CheckPrice) // -------------------- - // BOOKING CACHE APIS — no auth required (testing) + // BOOKING CACHE APIS — console/ops only // -------------------- - bookingCache := api.Group("/bookings/cache") + // Previously open "for testing", but live: listing the cache returns real + // bookings including customer delivery addresses, and the per-customer route + // takes a customer id straight from the URL. Behind console auth now. + bookingCache := api.Group("/bookings/cache", + middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(1, 3, 4)) bookingCache.Get("/", controllers.ListAllBookingsFromCache) bookingCache.Get("/customer/:customer_id", controllers.GetCustomerBookingsFromCache) bookingCache.Get("/:booking_id", controllers.GetBookingFromCache)