fix(api): add /api/readyz to authMiddleware bypass (GRO-2687 UAT fix) #237

2026-08-09T09:52:53Z

Flea Flicker commented

2026-08-09 09:52:53 +00:00

Summary

Fixes a UAT regression found by Shedward (GRO-2692): GET /api/readyz was returning 401 Unauthorized on the uat domain because authMiddleware did not whitelist the path.

Root cause

src/middleware/auth.ts only bypasses /api/auth/* and /api/health. The new /api/readyz monitoring endpoint was registered under /api/* but was not in the bypass list, so every unauthenticated request (including monitoring probes) hit the session check and got 401.

This is the Hono basePath middleware pattern: all /api/* routes go through authMiddleware regardless of registration order. Public routes must be in the middleware's explicit bypass list.

Fix

// Before
if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") {
// After
if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health" || c.req.path === "/api/readyz") {

Tests added

src/__tests__/readyz-auth-bypass.test.ts:

✅ /api/readyz passes through authMiddleware without auth (bypass confirmed)
✅ Non-whitelisted /api/* path blocked (auth guard still active)

UAT Playbook

No user-facing changes. This is an infrastructure monitoring endpoint. UAT_PLAYBOOK.md §4.0 TC-API-0.2 and TC-API-0.3 remain the applicable test cases (they were failing due to this bug; now they should pass).

## Summary Fixes a UAT regression found by Shedward (GRO-2692): `GET /api/readyz` was returning `401 Unauthorized` on the uat domain because `authMiddleware` did not whitelist the path. ### Root cause `src/middleware/auth.ts` only bypasses `/api/auth/*` and `/api/health`. The new `/api/readyz` monitoring endpoint was registered under `/api/*` but was not in the bypass list, so every unauthenticated request (including monitoring probes) hit the session check and got 401. This is the Hono basePath middleware pattern: all `/api/*` routes go through `authMiddleware` regardless of registration order. Public routes must be in the middleware's explicit bypass list. ### Fix ```ts // Before if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health") { // After if (c.req.path.startsWith("/api/auth/") || c.req.path === "/api/health" || c.req.path === "/api/readyz") { ``` ### Tests added `src/__tests__/readyz-auth-bypass.test.ts`: - ✅ `/api/readyz` passes through `authMiddleware` without auth (bypass confirmed) - ✅ Non-whitelisted `/api/*` path blocked (auth guard still active) ### UAT Playbook No user-facing changes. This is an infrastructure monitoring endpoint. `UAT_PLAYBOOK.md §4.0` TC-API-0.2 and TC-API-0.3 remain the applicable test cases (they were failing due to this bug; now they should pass). ### Related - [GRO-2692](/GRO/issues/GRO-2692) — UAT regression that surfaced this bug - [GRO-2687](/GRO/issues/GRO-2687) — feature issue for `/api/readyz` - [GRO-2678](/GRO/issues/GRO-2678) — parent incident cc @cpfarhood

Flea Flicker added 1 commit 2026-08-09 09:52:53 +00:00

fix(api): add /api/readyz to authMiddleware bypass list (GRO-2687)

CI / Lint & Typecheck (pull_request) Successful in 19s

Details

CI / Test (pull_request) Successful in 21s

Details

CI / Build & Push Docker Images (pull_request) Successful in 55s

Details

8f5a069e77

/api/readyz was returning 401 Unauthorized in UAT (GRO-2692 Shedward
regression). The authMiddleware for /api/* did not whitelist /api/readyz,
causing every unauthenticated probe request to be rejected.

Add /api/readyz to the bypass condition alongside /api/auth/* and
/api/health. Add readyz-auth-bypass.test.ts confirming the route passes
through the middleware without auth and that non-whitelisted paths still
block (503 when auth not configured).

Closes GRO-2692 regression (UAT fail).

Flea Flicker merged commit 9227cf4883 into dev

2026-08-09 09:54:36 +00:00

Flea Flicker referenced this pull request

2026-08-09 09:55:10 +00:00

promote(api): dev → uat — /api/readyz auth bypass fix + /health/ready revert (GRO-2687) #239

Flea Flicker referenced this pull request

2026-08-09 09:55:39 +00:00

promote(api): dev → uat — /api/readyz auth bypass fix + /health/ready revert (GRO-2687) #239

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/api#237