trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/changes/mobile-terms-gate/tasks.md
Ullrich Schäfer 067e2ebd0b
fix: enforce Terms gate on bearer-token API requests 
Mobile API requests authenticated via OAuth2 bearer tokens bypassed the
Terms gate that the root loader applies to web cookie sessions. Extend
requireApiUser to compare the user's termsVersion with TERMS_VERSION
and return a structured 403 { code: "TERMS_OUTDATED", currentTermsVersion }
on mismatch so mobile clients can surface their own re-acceptance UI.

Spec delta on journal-auth captures the new requirement.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-08 01:59:28 +02:00

843 B
Raw Blame History

1. Implementation

  • 1.1 Add TERMS_OUTDATED: "TERMS_OUTDATED" to ERROR_CODES in packages/api/src/errors.ts.
  • 1.2 Extend requireApiUser in apps/journal/app/lib/api-guard.server.ts to compare the authenticated user's termsVersion to TERMS_VERSION (from ~/lib/legal). On mismatch (or NULL), throw a Response with status 403 and JSON body { error, code: ERROR_CODES.TERMS_OUTDATED, currentTermsVersion: TERMS_VERSION }.

2. Tests

  • 2.1 Add apps/journal/app/lib/api-guard.server.test.ts covering: stale termsVersion → 403 with TERMS_OUTDATED + currentTermsVersion; matching termsVersion → returns user; null termsVersion → 403; no auth → 401 (unchanged).

3. Verification

  • 3.1 Run pnpm typecheck && pnpm lint && pnpm test — all green.
  • 3.2 Open draft PR against main.