From fd7086443482d5a11ea7de1d7f1c0ead8e7c6b13 Mon Sep 17 00:00:00 2001 From: Bugfix Subagent Date: Mon, 17 Aug 2026 12:12:47 +0000 Subject: [PATCH] fix(auth): keep public driver registration endpoints publicly accessible (TRU-149) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scope-middleware injection on the public driver registration endpoints (POST /subusers and POST /subusers/me) breaks the public registration contract — new drivers cannot hold a scope before they exist, so requiring one would make self-registration impossible. PublicSubuserRegistrationContractTest enforces the literal 'POST /subusers → registerPublicSubuser' / 'POST /subusers/me → registerPublicSubuser' signature. Adding the ScopeMiddleware call violates that contract and fails the test. Drop the ScopeMiddleware::requireScope() call from both public registration handlers; the in-method abuse controls (recaptcha, rate limits, MySQL GET_LOCK) remain the only gate, as before. Fixes CI on PR #397 (Required CI, PHP unit, PHP api, PHP integration). --- services/nginx/app/routes/subusersRoute.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/services/nginx/app/routes/subusersRoute.php b/services/nginx/app/routes/subusersRoute.php index c7af5e04..80c78c7e 100644 --- a/services/nginx/app/routes/subusersRoute.php +++ b/services/nginx/app/routes/subusersRoute.php @@ -2191,8 +2191,9 @@ class subusersRoute 'edit_subusers' => 'List chauffeur permission templates while editing chauffeur grants.', ]); + // Public registration endpoint — must stay publicly accessible (no + // scope check); new drivers cannot hold a scope before they exist. $this->post('/subusers', function () { - ScopeMiddleware::requireScope(Scope::SUBUSER_WRITE, '/subusers'); $this->registerPublicSubuser(); }); $this->get('/subusers/setup', function () { @@ -3087,8 +3088,9 @@ class subusersRoute 'edit_own_subusers' => 'Customers cannot edit chauffeur account profiles. They may only manage grants, permissions, and enabled state.', ]); // Public registration endpoint (alias of POST /subusers) matching OpenAPI: POST /subusers/me + // Must stay publicly accessible — no scope check here; new drivers do + // not hold a scope before they exist. $this->post('/subusers/me', function () { - ScopeMiddleware::requireScope(Scope::SUBUSER_WRITE, '/subusers/me'); $this->registerPublicSubuser(); }); }