Repository navigation
fix(#2861): prize-barcode 401 — resolve identity from cds.context.user - #2867
Merged
Merged
Conversation
…l 401 fix) The App Space checkpoint barcode still 401'd for logged-in visitors after the previous #2861 fix. Root cause: on a raw Express bootstrap route CAP's auth() middleware populates the authenticated identity on cds.context.user (the AsyncLocalStorage continuation), NOT on req.user — req.user is only set in CAP service handlers and in the mocked-basic-auth test harness. The handler read bare req.user, so every real XSUAA/IAS login resolved to anonymous → provision returned null → a hard 401. The integration test stayed green because that harness DOES set req.user, hiding the production-only defect. Fix (matches the existing idiom used by the working /api/alerts/me and /auth/user routes, and the devtoberfest Express routes): - prize-barcode-handler.js: resolve `req.user || cds.context.user`, guard the anonymous sentinel, and provision via `provisionDbUser(user, ['ID'])` — the canonical get-or-create for raw Express routes (tiered iss/sub resolver, mints on first visit; takes the user object directly, no CAP-request .tx coupling, unlike getOrProvisionDbUser). - test/unit/prize-barcode-handler.test.js: rewritten to the new contract and adds the operative regression guard — identity present on cds.context.user, absent on req.user, must 200 (not 401). - Corrected the misleading "bootstrap bypasses the middleware chain" comments in srv/server.js and the integration test; the eager-bootstrap middleware mount is correct (cds.middlewares is a lazy getter, populated on first access). Verified: unit 8/8, integration (real-server boot, in-memory sqlite) 2/2, package-boundaries OK.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The App Space checkpoint "Claim your prize" barcode (
GET /api/my-prize-barcode) still returned 401 for every logged-in visitor after the previous #2861 fix — the QR rendered as a broken image.Root cause
On a raw Express bootstrap route, CAP's
auth()middleware populates the authenticated identity oncds.context.user(the AsyncLocalStorage continuation), not onreq.user.req.useris only set in CAP service handlers and in the mocked-basic-auth test harness.The handler read bare
req.user→ every real XSUAA/IAS login resolved to anonymous →provisionreturned null → hard 401. The integration test stayed green because that harness does setreq.user, hiding the production-only defect.Fix
Uses the existing codebase idiom (the working
/api/alerts/me,/auth/user, and devtoberfest Express routes) — no reinvention:srv/lib/prize-barcode-handler.js— resolvereq.user || cds.context.user, guard the anonymous sentinel, provision viaprovisionDbUser(user, ['ID'])(canonical get-or-create for raw Express routes; tiered iss/sub resolver, mints on first visit; takes the user object directly — no CAP-request.txcoupling, unlikegetOrProvisionDbUser).test/unit/prize-barcode-handler.test.js— rewritten to the new contract; adds the operative regression guard: identity present oncds.context.user, absent onreq.user, must 200 not 401.srv/server.jsand the integration test. The eager-bootstrap middleware mount is actually correct (cds.middlewaresis a lazy getter, populated on first access — verified against @sap/cds 10.1.0 source).Verification
cds.context.user-only regression guard)lint:package-boundaries: OKNot yet verified against a live authenticated request on DEV (no tech-user creds locally); the DEV deploy of this PR plus a real App Space click is the final confirmation.