Aditya - Job Application Listing Page: allow public read access to the FAQ list

[AdiDubbs]

Description

The job listing page at /collaboration is public - it does not require signing in. Its FAQ section reads from GET /faqs, which required a token, so a signed-out visitor received a 401 and got an error where the FAQs should be. This PR makes the changes to allow public read access to the FAQ list

This issue concerns Item 33.

Related PRS (if any):

Frontend: OneCommunityGlobal/HighestGoodNetworkApp#5473

Main changes explained:

1. Added GET /api/faqs to the global auth allowlist in startup/middleware.js. That app.all('*') gate runs before every route, so removing the router's own guard alone had no effect. It is matched on req.path exactly rather than as a prefix, so the search, history, unanswered and write routes are untouched.
2. Removed verifyToken from the /faqs route in faqRouter.js. getAllFAQs does not read req.user, so nothing in the handler depended on it.

GET /api/jobs is already public in the same allowlist — that is how the job listing itself loads for visitors — so this follows the existing pattern for this page.

How to test:

1. Check out this branch and run npm install
2. Start Redis: redis-server --daemonize yes
3. Run npm run dev
4. Confirm the FAQ list is now public, and that nothing else opened up:

curl -o /dev/null -w "%{http_code}\n" http://localhost:4500/api/faqs              # 200
curl -o /dev/null -w "%{http_code}\n" "http://localhost:4500/api/faqs/search?q=a" # 401
curl -o /dev/null -w "%{http_code}\n" http://localhost:4500/api/faqs/unanswered   # 401
curl -o /dev/null -w "%{http_code}\n" http://localhost:4500/api/faqs/123/history  # 401
curl -o /dev/null -w "%{http_code}\n" -X POST -H "Content-Type: application/json" -d '{}' http://localhost:4500/api/faqs   # 401
curl -o /dev/null -w "%{http_code}\n" -X DELETE http://localhost:4500/api/faqs/123 # 401

5. Signed in, confirm /api/faqs, /api/faqs/search and /api/faqs/unanswered all return 200 as before — authenticated access is unchanged.
6. Run npm run lint

Note:

Not addressed here, found while testing:

• GET /faqs/unanswered and DELETE /faqs/unanswered/:id check only for a token, not for manageFAQs, unlike the other management endpoints. The UI hides that page behind the permission, but any signed-in user can call those endpoints directly. Raised separately rather than mixed into this change.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
50.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[DeMoliT1on]

Tested locally for backend PR changes branch Aditya_fix_public_faq_endpoint and observed the following things.

---

Overall Assessment

Verified Working

• Public FAQ Endpoint: GET /api/faqs successfully returns a 200 OK status without an Authorization header.
• Protected FAQ Sub-routes: Routes requiring authentication (e.g., GET /api/faqs/search) correctly return 401 Unauthorized when requested without a valid token.
• Authenticated Access Preserved: Requests to protected endpoints with a valid JWT token continue to return 200 OK as expected.

Screenshots

The implementation accurately opens public access strictly for GET /api/faqs while keeping administrative and sub-routes securely protected.
Approved!