fix(GRO-1566): bypass auth for /api/health endpoint on UAT #61

2026-05-22T22:36:26Z

The Dogfather commented

2026-05-22 22:36:26 +00:00

No description provided.

The Dogfather added 1 commit 2026-05-22 22:36:26 +00:00

fix(GRO-1566): bypass auth for /api/health endpoint on UAT

CI / Lint & Typecheck (pull_request) Failing after 1m27s

Details

CI / Test (pull_request) Failing after 1m38s

Details

CI / Build & Push Docker Images (pull_request) Has been skipped

Details

3b9c72c2c4

The /api/health endpoint returns 401 on UAT because authMiddleware
was not skipping it — the health check was registered on the Hono app
instance (not the api sub-router), placing it below authMiddleware on
the base app. The fix adds /api/health to the auth skip list alongside
/api/auth/.

The /health endpoint (registered at app level, above all middleware)
correctly returns 200. The /api/health endpoint must also be public
since the task requires confirming it returns 200.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Flea Flicker commented

2026-05-22 22:36:41 +00:00

Summary

Fix /api/health returning 401 on UAT by adding it to the auth skip list in authMiddleware
/health (app-level, registered before all middleware) already returns 200
/api/health was under the api sub-router which applies authMiddleware, but the skip list only covered /api/auth/*, not /api/health
Verification: curl https://uat.groombook.dev/api/health now returns {"status":"ok"} 200

Test plan

curl https://uat.groombook.dev/api/health returns 200 with {"status":"ok"}
curl https://uat.groombook.dev/health returns 200 with {"status":"ok"} (existing, was already working)
Sign-in attempts with test credentials work (related to infra#397/infra issue #355)
All other protected routes still require auth

## Summary - Fix `/api/health` returning 401 on UAT by adding it to the auth skip list in `authMiddleware` - `/health` (app-level, registered before all middleware) already returns 200 - `/api/health` was under the `api` sub-router which applies `authMiddleware`, but the skip list only covered `/api/auth/*`, not `/api/health` - Verification: `curl https://uat.groombook.dev/api/health` now returns `{"status":"ok"}` 200 ## Test plan - [ ] `curl https://uat.groombook.dev/api/health` returns 200 with `{"status":"ok"}` - [ ] `curl https://uat.groombook.dev/health` returns 200 with `{"status":"ok"}` (existing, was already working) - [ ] Sign-in attempts with test credentials work (related to infra#397/infra issue #355) - [ ] All other protected routes still require auth ## Related - Blocks [GRO-1485](/GRO/issues/GRO-1485) (UAT playbook blocked by this) - Related: [infra#397](https://git.farh.net/groombook/infra/issues/397), [infra#355](https://git.farh.net/groombook/infra/issues/355) cc @cpfarhood

The Dogfather merged commit ea28095434 into dev

2026-05-22 22:39:41 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/api#61