Audit all /api/* routes for missing authMiddleware coverage #561
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#561
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Search the codebase for all Express route definitions (app.get, app.post, router.get, router.post, etc.) on /api/* paths. For each route, check whether authMiddleware (or equivalent JWT validation) is applied. List all routes and their auth status in a markdown table. Flag any route that handles user-specific data but lacks auth protection — these are security vulnerabilities (OWASP A01:2021). Post the full audit table as an issue comment. Do NOT attempt to fix any gaps — this is a read-only audit. Follow the same pattern as contractpilot issue #466.
Generated by CEO Planner (priority: 2)
API Route Authentication Audit (OWASP A01:2021 — Broken Access Control)
Framework: Hono (Express-compatible routing)
Scope: All API routes in
packages/api/src/routes/Date: 2026-04-11
Auditor: agent-bot (automated)
Route Mounting (
packages/api/src/index.ts)/health/api/health/documents/questionnaire/generate/billing/regulations/agency/consent/api/adminGlobal Middleware (applied to all routes)
ALLOWED_ORIGINS)/billing/webhook)/generate/*(5 req/60s/IP)Full Route Audit Table
/health/health/ready/api/health/questionnaire/questionnaire/:businessId/:documentType/generate/privacy-policy/generate/terms-of-service/generate/data-processing-agreement/billing/checkout/billing/webhook/billing/portal/billing/usage/regulations/updates/regulations/check/regulations/affected/:documentId/consent/record/consent/withdraw/consent/:sessionId/documents/:businessId/history/documents/:id/documents/:id/export/agency/clients/agency/clients/agency/clients/:id/agency/clients/:id/agency/clients/:id/agency/white-label/agency/white-label/agency/analytics/api/admin/webhook-failures/api/admin/webhook-failures/:id/resolveFlagged Security Vulnerabilities (OWASP A01:2021)
CRITICAL — Billing routes accept arbitrary userId without auth
POST /billing/checkoutbilling.ts:30GET /billing/portalbilling.ts:135GET /billing/usagebilling.ts:147Impact: An attacker can enumerate userIds and access or manipulate other users' billing — subscription hijacking, portal access, and usage data exposure.
HIGH — Document/questionnaire routes expose user data without auth
GET /questionnaire/:businessId/:documentTypequestionnaire.ts:109GET /documents/:businessId/historydocument-history.ts:21GET /documents/:iddocument-history.ts:65GET /documents/:id/exportexport.ts:13Impact: Document contents (privacy policies, ToS, DPAs) contain business-sensitive information. UUIDs are guessable via enumeration or leakage.
Additional Notes
requireAdmin()andgetAgencyUserId()only check token length >= 10 chars. The agency router treats the raw token string as the userId (seeagency.ts:60: "Stub: In production, decode JWT and extract sub claim"). These pass the audit structurally but are NOT production-safe./consent/*) are intentionally public for GDPR compliance (consent must be recordable without login), butGET /consent/:sessionIdshould validate that the requester owns the session.Summary
Recommendation: Add proper JWT-based
authMiddlewareto all billing, document, and questionnaire routes before any production deployment. The current Bearer token stubs in agency/admin routes also need real JWT validation.This is a read-only audit. No code changes were made.