Skip to content

Fix-[Web]: Guard timesheet report proxy routes and forward the access token #4464

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NdekoCode wants to merge 6 commits into
base: develop
Choose a base branch
from
+48 −7
Open

Fix-[Web]: Guard timesheet report proxy routes and forward the access token #4464

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
94ae190
fix(web): guard timesheet report proxy routes and forward the access …
NdekoCode Sep 5, 2026
2bd200f
fix(web): answer 503 instead of 401 when the session check cannot rea…
NdekoCode Sep 6, 2026
160e52a
refactor(web): build the 401/503 denial response inside authenticated…
NdekoCode Sep 6, 2026
416c72c
docs(web): state the 401/503 split in the report route comments
NdekoCode Sep 6, 2026
461c3e2
fix(web): keep Gauzy's own error status in authenticatedGuard.deny()
NdekoCode Sep 6, 2026
45fb4fe
fix(web): read the denial status and message from the same upstream body
NdekoCode Sep 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions apps/web/app/api/timesheet/activity/report/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import { NextRequest } from 'next/server';
import { NextRequest, NextResponse } from 'next/server';
import { authenticatedGuard } from '@/core/services/server/guards/authenticated-guard-app';
import { getActivityReportRequest } from '@/core/services/server/requests/timesheet';
import { IActivityRequestParams } from '@/core/services/server/requests/timesheet';
import { ETimeLogType } from '@/core/types/generics/enums/timer';
Expand All @@ -11,7 +12,13 @@ export const runtime = 'nodejs';
* Fetches activity report data based on provided query parameters
*/
export async function GET(req: NextRequest) {
const res = new NextResponse();

try {
// Authenticate before reading parameters so anonymous callers always get 401
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
Outdated
const { user, access_token } = await authenticatedGuard(req, res);
if (!user) return NextResponse.json({ message: 'Unauthorized' }, { status: 401 });
Comment thread
NdekoCode marked this conversation as resolved.
Outdated

const searchParams = req.nextUrl.searchParams;

const params: Partial<IActivityRequestParams> = {
Expand Down Expand Up @@ -63,7 +70,7 @@ export async function GET(req: NextRequest) {
}

// Fetch activity report data
const data = await getActivityReportRequest(params as IActivityRequestParams);
const { data } = await getActivityReportRequest(params as IActivityRequestParams, access_token);

return new Response(JSON.stringify(data), {
status: 200,
Expand Down
13 changes: 10 additions & 3 deletions apps/web/app/api/timesheet/time-log/report/daily/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,19 @@
import { NextRequest } from 'next/server';
import { NextRequest, NextResponse } from 'next/server';
import { authenticatedGuard } from '@/core/services/server/guards/authenticated-guard-app';
import { getTimeLogReportDailyRequest } from '@/core/services/server/requests/timesheet';
import { ITimeLogRequestParams } from '@/core/services/server/requests/timesheet';

export const dynamic = 'force-dynamic';
export const runtime = 'nodejs';

export async function GET(req: NextRequest) {
const res = new NextResponse();

try {
// Authenticate before reading parameters so anonymous callers always get 401
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
Outdated
const { user, access_token } = await authenticatedGuard(req, res);
if (!user) return NextResponse.json({ message: 'Unauthorized' }, { status: 401 });

const searchParams = req.nextUrl.searchParams;

const params: Partial<ITimeLogRequestParams> = {
Expand Down Expand Up @@ -53,9 +60,9 @@ export async function GET(req: NextRequest) {
};
}

const response = await getTimeLogReportDailyRequest(params as ITimeLogRequestParams);
const { data } = await getTimeLogReportDailyRequest(params as ITimeLogRequestParams, access_token);

return new Response(JSON.stringify(response), {
return new Response(JSON.stringify(data), {
status: 200,
headers: {
'Content-Type': 'application/json'
Expand Down
Loading