fix: require authentication before issuing refreshed tokens#9031
Open
Yzgaming005 wants to merge 3 commits into
Open
fix: require authentication before issuing refreshed tokens#9031Yzgaming005 wants to merge 3 commits into
Yzgaming005 wants to merge 3 commits into
Conversation
added 3 commits
June 27, 2026 12:43
- Updated errorHandler to recognize body-parser parse errors (entity.parse.failed)
and return HTTP 400 with { success: false, message } shape
- Added ZodError recognition in errorHandler returning 400 with structured issues
- Added catchAsync utility to forward async errors to Express error handler
- Wrapped auth and job route handlers with catchAsync
- Added regression tests for malformed JSON, invalid registration, and missing fields
Closes SecureBananaLabs#9020
Closes SecureBananaLabs#9018
Ref: SecureBananaLabs#743
- Added 5 MB file size limit to Multer configuration - Updated errorHandler to recognize LIMIT_FILE_SIZE errors and return HTTP 413 - Wrapped upload route with catchAsync for proper error forwarding - Added regression tests for small (accepted) and oversized (rejected) uploads Closes SecureBananaLabs#9028 Ref: SecureBananaLabs#743
- Protected /api/auth/refresh route with authMiddleware - Updated refreshToken service to accept subject and role parameters - Updated refresh controller to pass authenticated user's sub and role - Added regression tests for unauthenticated rejection and identity preservation Closes SecureBananaLabs#9030 Ref: SecureBananaLabs#743
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/claim #9030
Summary
POST /api/auth/refreshroute withauthMiddleware(bearer token required)refreshTokenservice to acceptsubjectandroleparameters instead of hardcoded valuesrefreshcontroller to pass authenticated user'ssubandrolefromreq.userTest Results
Validation
Ref: #743