From 0b984752e0f2b67fdeaf63fc76d810626254885a Mon Sep 17 00:00:00 2001 From: Aditya Dubey Date: Thu, 27 Aug 2026 15:25:30 -0700 Subject: [PATCH] feature: allow public read access to the FAQ list The job listing page at /collaboration is reachable without signing in, and its FAQ section reads from GET /faqs. Opens that one route in the global auth allowlist and drops its verifyToken guard. Matched on the exact path so the search, history, unanswered and write routes stay authenticated. Co-Authored-By: Claude Opus 5 --- src/routes/faqRouter.js | 5 ++++- src/startup/middleware.js | 8 ++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/routes/faqRouter.js b/src/routes/faqRouter.js index 3c5c509c4c..0374cb84ab 100644 --- a/src/routes/faqRouter.js +++ b/src/routes/faqRouter.js @@ -51,7 +51,10 @@ const checkFaqPermission = (requiredPermission) => (req, res, next) => { // Define routes with verifyToken and checkFaqPermission router.get('/faqs/search', verifyToken, faqController.searchFAQs); -router.get('/faqs', verifyToken, faqController.getAllFAQs); +// Public: the job listing page at /collaboration is reachable without signing in, +// and its FAQ section reads from here. getAllFAQs does not use req.user. +// Every other FAQ route below stays behind verifyToken. +router.get('/faqs', faqController.getAllFAQs); router.post('/faqs', verifyToken, checkFaqPermission('manageFAQs'), faqController.createFAQ); router.put('/faqs/:id', verifyToken, checkFaqPermission('manageFAQs'), faqController.updateFAQ); router.delete('/faqs/:id', verifyToken, checkFaqPermission('manageFAQs'), faqController.deleteFAQ); diff --git a/src/startup/middleware.js b/src/startup/middleware.js index 565b996738..72a8439ed9 100644 --- a/src/startup/middleware.js +++ b/src/startup/middleware.js @@ -91,6 +91,14 @@ module.exports = function (app) { return; } + // Public FAQ list: the job listing page at /collaboration is reachable without + // signing in, and its FAQ section reads from here. Matched exactly so the + // search, history and unanswered FAQ routes stay behind authentication. + if (req.path === '/api/faqs' && req.method === 'GET') { + next(); + return; + } + if (req.originalUrl.startsWith('/api/bluesky')) { next(); return;