jeffemmett
/
rspace-online
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: whitelist rvote GET API as public + guard campaign wizard auth client-side 

1. Add GET /rvote/api/* to public endpoint whitelist so proposal
   listings work on private/permissioned spaces without auth.
2. Campaign wizard now checks for auth token before POSTing,
   showing "Please sign in" instead of a cryptic 401.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jeff Emmett 2026-03-24 12:58:21 -07:00
parent 7ad5666b9a
commit 7f327eb07a
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/rsocials/components/folk-campaign-wizard.ts
View File

@ -170,6 +170,12 @@ export class FolkCampaignWizard extends HTMLElement {
} }
private async createWizard(): Promise<string | null> { private async createWizard(): Promise<string | null> {
const token = (window as any).__authToken || localStorage.getItem('auth_token') || '';
if (!token) {
this._error = 'Please sign in to create a campaign wizard';
this.render();
return null;
}
try { try {
const res = await this.apiFetch('/api/campaign/wizard', { const res = await this.apiFetch('/api/campaign/wizard', {
method: 'POST', method: 'POST',

3
server/index.ts
View File

@ -2322,7 +2322,8 @@ for (const mod of getAllModules()) {
|| pathname.includes("/rcart/api/payments") || pathname.includes("/rcart/api/payments")
|| pathname.includes("/rcart/pay/") || pathname.includes("/rcart/pay/")
|| pathname.includes("/rwallet/api/") || pathname.includes("/rwallet/api/")
|| pathname.includes("/rdesign/api/"); || pathname.includes("/rdesign/api/")
|| (c.req.method === "GET" && pathname.includes("/rvote/api/"));
if (!isHtmlRequest && !isPublicEndpoint && (vis === "private" || vis === "permissioned")) { if (!isHtmlRequest && !isPublicEndpoint && (vis === "private" || vis === "permissioned")) {
const token = extractToken(c.req.raw.headers); const token = extractToken(c.req.raw.headers);