spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

GET /api/interests requires auth but the public /geography page calls it anonymously (401) #312

New Issue
Closed
opened 2026-07-01 21:14:16 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-01 21:14:16 +00:00
Owner
Copy Link
Copy Source

Found by the E2E anonymous walk (epic #307) once the suite ran API-connected from https://localhost:4200.

Symptom

Anonymous visitors on the public /geography route always get an empty interest filter: the page's InterestsAdminService.getAll() call to GET /api/interests returns 401.

Root cause

SpikerSoft.Api/Domain/Interests/InterestsController.cs has class-level [Authorize], and the read-only GetAll action has no [AllowAnonymous] override. The write actions (create/update/delete) are correctly role-gated to Admin/Staff, but the list endpoint only returns the public catalog of interest areas (key, display name, icon, sort order) — nothing user-specific.

Fix

Add [AllowAnonymous] to GetAll so the public geography experience can render its interest filter. Write endpoints stay role-gated.

Part of epic #307.

Found by the E2E anonymous walk (epic #307) once the suite ran API-connected from `https://localhost:4200`. ## Symptom Anonymous visitors on the public `/geography` route always get an empty interest filter: the page's `InterestsAdminService.getAll()` call to `GET /api/interests` returns **401**. ## Root cause `SpikerSoft.Api/Domain/Interests/InterestsController.cs` has class-level `[Authorize]`, and the read-only `GetAll` action has no `[AllowAnonymous]` override. The write actions (create/update/delete) are correctly role-gated to Admin/Staff, but the list endpoint only returns the public catalog of interest areas (key, display name, icon, sort order) — nothing user-specific. ## Fix Add `[AllowAnonymous]` to `GetAll` so the public geography experience can render its interest filter. Write endpoints stay role-gated. Part of epic #307.
spikerj added the bug label 2026-07-01 21:14:16 +00:00
spikerj commented 2026-07-01 22:45:54 +00:00
Author
Owner
Copy Link
Copy Source

Resolved in spikersoft-backend PR #50 (merged to master). GET /api/interests is now [AllowAnonymous] (public catalog only); create/update/delete remain Admin/Staff-gated. The public /geography interest filter can populate for visitors. Closing.

Resolved in spikersoft-backend PR #50 (merged to `master`). `GET /api/interests` is now `[AllowAnonymous]` (public catalog only); create/update/delete remain Admin/Staff-gated. The public /geography interest filter can populate for visitors. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#312