feat(auth): add public GET /api/auth/config endpoint#3210
Conversation
Expose auth feature flags (sign.in, sign.up) so the Vue frontend can display a warning when signin/signup is disabled server-side. Only boolean flags are returned — no secrets exposed.
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughA public API endpoint Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3210 +/- ##
==========================================
+ Coverage 90.19% 90.21% +0.02%
==========================================
Files 56 56
Lines 1183 1186 +3
Branches 239 239
==========================================
+ Hits 1067 1070 +3
Misses 105 105
Partials 11 11 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds a new public, rate-limited endpoint in the auth module so the frontend can query whether server-side signin/signup are enabled.
Changes:
- Add
GET /api/auth/configroute (placed before the:strategywildcard route). - Implement
auth.getConfigcontroller returningsign.in/sign.upas booleans via the standard success response helper.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| modules/auth/routes/auth.routes.js | Registers the new public GET /api/auth/config endpoint with rate limiting. |
| modules/auth/controllers/auth.controller.js | Adds getConfig controller and exports it for routing. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
modules/auth/routes/auth.routes.js (1)
16-18: Please add a contract test for this new public route.This endpoint now has a frontend-facing contract and depends on ordering ahead of
/api/auth/:strategy. A small test covering the exact JSON body and route precedence would make regressions much harder.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@modules/auth/routes/auth.routes.js` around lines 16 - 18, Add a contract test that calls the public route '/api/auth/config' (which is registered with authLimiter and handled by auth.getConfig) and asserts the exact JSON response body shape/values expected by the frontend; also include a test that verifies route precedence by ensuring '/api/auth/config' resolves before the dynamic '/api/auth/:strategy' route (e.g., request '/api/auth/config' does not get matched as a strategy). Place tests alongside other auth route tests and use the same server/bootstrap helpers so ordering in the router is exercised.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@modules/auth/controllers/auth.controller.js`:
- Around line 216-222: getConfig currently uses responses.success which wraps
the payload under data; change it to return the documented top-level object
instead of the success envelope by sending a plain JSON response (e.g.,
res.status(200).json(...)) that contains { sign: { in: !!config.sign.in, up:
!!config.sign.up, oauthGoogle: !!config.sign.oauthGoogle, oauthGithub:
!!config.sign.oauthGithub } } (or the actual oauth flag names present on
config.sign per the JSDoc) so clients receive sign.* at the top level; remove
the responses.success call and ensure getConfig exports/returns the new
top-level payload.
---
Nitpick comments:
In `@modules/auth/routes/auth.routes.js`:
- Around line 16-18: Add a contract test that calls the public route
'/api/auth/config' (which is registered with authLimiter and handled by
auth.getConfig) and asserts the exact JSON response body shape/values expected
by the frontend; also include a test that verifies route precedence by ensuring
'/api/auth/config' resolves before the dynamic '/api/auth/:strategy' route
(e.g., request '/api/auth/config' does not get matched as a strategy). Place
tests alongside other auth route tests and use the same server/bootstrap helpers
so ordering in the router is exercised.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f9649ab7-e86e-421c-b7a5-0ad6f3677acc
📒 Files selected for processing (2)
modules/auth/controllers/auth.controller.jsmodules/auth/routes/auth.routes.js
Summary
GET /api/auth/configendpoint that returns public auth feature flags (sign.in,sign.up) as booleansScope
authnonelowValidation
npm run lintnpm testGuardrails check
.env*,secrets/**, keys, tokens)Notes for reviewers
:strategywildcard to avoid being swallowed by it. No existing routes or behaviour are modified.Summary by CodeRabbit