pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

[Agent] Issue #625: grep all route definitions appget apppos #628

Open
pook wants to merge 61 commits from agent-task/625 into main
pull from: agent-task/625
merge into: pook:main
Conversation 0 Commits 61 Files changed 69 +6710 -79
pook commented 2026-04-11 06:46:04 -04:00
Owner
Copy link

Closes #625

Changes

feat: issue #625 grep-all-route-definitions-appget-apppos (agent task liancebot625)

Acceptance Criteria

Grep all route definitions (app.get, app.post, router.*, etc.) and identify any endpoints lacking authMiddleware. ContractPilot had a similar vulnerability (unprotected /audit route fixed in PR #424) — verify ComplianceBot doesn't have the same gap.

Steps:

  1. Find all route definition files
  2. For each route, check if authMiddleware or equivalent auth guard is applied
  3. List all unprotected routes in a comment
  4. Add authMiddleware to any unprotected routes (except /health, webhook receivers, and Stripe webhook endpoint)
  5. Add a test for each newly protected route verifying 401 without token

Acceptance: Zero unprotected API routes (except intentionally public ones), tests added for each fix.

Generated by CEO Planner (priority: 2)

Tokens: 32 in / 10297 out

Closes #625 ## Changes feat: issue #625 grep-all-route-definitions-appget-apppos (agent task liancebot625) ## Acceptance Criteria Grep all route definitions (app.get, app.post, router.*, etc.) and identify any endpoints lacking authMiddleware. ContractPilot had a similar vulnerability (unprotected /audit route fixed in PR #424) — verify ComplianceBot doesn't have the same gap. Steps: 1. Find all route definition files 2. For each route, check if authMiddleware or equivalent auth guard is applied 3. List all unprotected routes in a comment 4. Add authMiddleware to any unprotected routes (except /health, webhook receivers, and Stripe webhook endpoint) 5. Add a test for each newly protected route verifying 401 without token Acceptance: Zero unprotected API routes (except intentionally public ones), tests added for each fix. --- *Generated by CEO Planner (priority: 2)* Tokens: 32 in / 10297 out
feat: issue #625 grep-all-route-definitions-appget-apppos (agent task liancebot625)
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
3ba3dc7e72
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
This pull request has changes conflicting with the target branch.
  • .forgejo/workflows/ci.yml
  • bun.lock
  • package.json
  • packages/api/src/db/schema.ts
  • packages/api/src/index.ts
  • packages/api/src/middleware/auth.ts
  • packages/api/src/middleware/csrf.ts
  • packages/api/src/middleware/rate-limit.ts
  • packages/api/src/middleware/security-headers.ts
  • packages/api/src/routes/admin.ts
  • packages/api/src/routes/billing.ts
  • packages/api/src/routes/export.ts
  • packages/api/src/routes/generate-tos.ts
  • packages/api/src/routes/generate.ts
  • packages/api/src/routes/health.ts
  • packages/api/src/routes/questionnaire.ts
  • packages/api/src/services/document-generator.ts
  • packages/api/src/services/llm.ts
  • packages/api/src/templates/index.ts
  • packages/api/tsconfig.json
  • packages/shared/src/types.ts
  • packages/web/src/app/questionnaire/page.tsx
  • packages/web/src/components/documents/DocumentList.tsx
  • packages/web/src/components/questionnaire/ReviewStep.tsx
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin agent-task/625:agent-task/625
git switch agent-task/625
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!628
No description provided.