fix(auth): add /api/readyz to auth bypass list (GRO-2692) #238

2026-08-09T09:53:33Z

Flea Flicker commented

2026-08-09 09:53:33 +00:00

Summary

UAT regression (GRO-2692) found that GET /api/readyz returns 401 instead of the expected 200/503 because the endpoint was not included in authMiddleware's bypass list.

Root cause: app.basePath("/api") + api.use("*", authMiddleware) applies to all /api/* paths regardless of route registration order (Hono basePath middleware bypass). Public routes must be explicitly listed in the authMiddleware bypass condition.

Fix: Add || c.req.path === "/api/readyz" to the bypass check in src/middleware/auth.ts, alongside the existing /api/health bypass.

Changed files

src/middleware/auth.ts — one-line addition to public route bypass list

UAT Playbook

No UAT_PLAYBOOK.md change needed — §4.0 TC-API-0.2 and TC-API-0.3 already cover this endpoint correctly; the fix makes the endpoint accessible as specified.

cc @cpfarhood

## Summary UAT regression (GRO-2692) found that `GET /api/readyz` returns 401 instead of the expected 200/503 because the endpoint was not included in `authMiddleware`'s bypass list. **Root cause:** `app.basePath("/api")` + `api.use("*", authMiddleware)` applies to **all** `/api/*` paths regardless of route registration order (Hono basePath middleware bypass). Public routes must be explicitly listed in the `authMiddleware` bypass condition. **Fix:** Add `|| c.req.path === "/api/readyz"` to the bypass check in `src/middleware/auth.ts`, alongside the existing `/api/health` bypass. ## Changed files - `src/middleware/auth.ts` — one-line addition to public route bypass list ## UAT Playbook No UAT_PLAYBOOK.md change needed — §4.0 TC-API-0.2 and TC-API-0.3 already cover this endpoint correctly; the fix makes the endpoint accessible as specified. cc @cpfarhood

Flea Flicker added 1 commit 2026-08-09 09:53:34 +00:00

fix(auth): add /api/readyz to auth middleware bypass list (GRO-2692)

CI / Lint & Typecheck (pull_request) Successful in 24s

Details

CI / Test (pull_request) Successful in 35s

Details

CI / Build & Push Docker Images (pull_request) Successful in 1m19s

Details

7dfa1ad830

/api/readyz is a public monitoring endpoint like /api/health.
app.basePath("/api") + api.use("*", authMiddleware) applies to all
/api/* paths regardless of route registration order (GRO-2692 UAT
failure: Hono basePath middleware bypass).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Flea Flicker merged commit 413849f066 into dev

2026-08-09 10:15:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/api#238