fix: match parameterized public auth routes

2026-07-21 21:59:03 -07:00
parent d9e61ce1b7
commit a2a2bee71e
3 changed files with 110 additions and 2 deletions
@@ -172,8 +172,16 @@ function csrfValidationMiddleware(req, res, next) {
    '/api/v1/system/update-notify'
  ];

-  const isExcluded = excludedPaths.some(path => req.path === path) ||
-                     req.path.startsWith('/api/v1/auth/gate/');
+  const isExcluded = excludedPaths.some(path => {
+    if (req.path === path) return true;
+    // Allow `:param` placeholders to match any single segment. Pre-existing
+    // bug — literal ':token' never matched real tokens — fixed under DC-053.
+    if (path.includes(':')) {
+      const pattern = '^' + path.replace(/:[A-Za-z_][A-Za-z0-9_]*/g, '[^/]+') + '$';
+      return new RegExp(pattern).test(req.path);
+    }
+    return false;
+  }) || req.path.startsWith('/api/v1/auth/gate/');

  if (isExcluded) {
    return next();