wangdl/api-server
2
0
Fork 0
Code Issues 36 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: correct admin path bypass in global JwtAuthGuard
All checks were successful
Deploy API Server / build-and-deploy (push) Successful in 46s
Details

Browse Source 
request.path includes the global 'api' prefix, so /admin/learning
routes appear as /api/admin/learning. Bypass /api/admin in addition
to existing /admin-api and /internal paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
wangdl 2026-06-18 19:00:38 +08:00
parent bc11adfbac
commit 04da939a22
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/common/guards/jwt-auth.guard.ts
View File

@ -33,7 +33,7 @@ export class JwtAuthGuard implements CanActivate {
const request = context.switchToHttp().getRequest<Request>(); const request = context.switchToHttp().getRequest<Request>();
// Admin and internal routes use their own auth guards // Admin and internal routes use their own auth guards
if (request.path.startsWith('/admin') || request.path.startsWith('/internal')) { if (request.path.startsWith('/api/admin') || request.path.startsWith('/admin-api') || request.path.startsWith('/internal')) {
return true; return true;
} }