Doormile/doormile_backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: put the booking cache endpoints behind console auth

Browse Source 
/api/v1/bookings/cache/* was open "for testing" but is live in production:
listing it returns real bookings including customer delivery addresses, and
/customer/:customer_id takes the customer straight from the URL, so anyone
could enumerate a given customer's bookings without credentials.

Now requires a console token (roles 1/3/4), matching the rest of the admin
surface. The /crm/* group stays open by deliberate decision — the field-sales
Flutter app authenticates with nothing and would break; revisit when that app
can send a key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Suriya
2026-08-05 18:22:42 +05:30
parent c8a9b5d797
commit 4d03676e60
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
routes/routes.go
View File

@@ -373,9 +373,13 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) {
api.Post("/pricing/check", controllers.CheckPrice)
// --------------------
// BOOKING CACHE APIS — no auth required (testing)
// BOOKING CACHE APIS — console/ops only
// --------------------
bookingCache := api.Group("/bookings/cache")
// Previously open "for testing", but live: listing the cache returns real
// bookings including customer delivery addresses, and the per-customer route
// takes a customer id straight from the URL. Behind console auth now.
bookingCache := api.Group("/bookings/cache",
middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(1, 3, 4))
bookingCache.Get("/", controllers.ListAllBookingsFromCache)
bookingCache.Get("/customer/:customer_id", controllers.GetCustomerBookingsFromCache)
bookingCache.Get("/:booking_id", controllers.GetBookingFromCache)