From 72161e8c4f6a3769533d3f69706228634c3b5a53 Mon Sep 17 00:00:00 2001 From: Stephen Adamson Date: Mon, 6 Jul 2026 19:22:08 +0100 Subject: [PATCH] docs(backend): clarify auth fallback rationale in reserve handler MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Expands inline comments to explain why the Bearer token fallback is deliberately kept — it serves 22+ test invocations that call ReserveSlotHandler directly without middleware, never executes in production, and acts as defense-in-depth. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus --- backend/handlers/bookings/reserve.go | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/backend/handlers/bookings/reserve.go b/backend/handlers/bookings/reserve.go index d2f06c0..1e2264c 100644 --- a/backend/handlers/bookings/reserve.go +++ b/backend/handlers/bookings/reserve.go @@ -69,11 +69,15 @@ func ReserveSlotHandler(w http.ResponseWriter, r *http.Request) { } } - // c. Detect auth: try context first, then parse Bearer token from Authorization header + // c. Detect auth: try context first (set by OptionalAuth middleware). + // The inline Bearer fallback below is a safety net for the 22+ test + // invocations that call ReserveSlotHandler via http.HandlerFunc directly + // (without middleware). Keeping it is deliberate: the fallback never + // executes in production (middleware always sets context first), removing it + // would require refactoring those tests, and it acts as defense-in-depth + // against accidental middleware misconfiguration. userID, hasUser := r.Context().Value(mw.UserIDKey).(string) hasAuth := hasUser && userID != "" - - // If no user in context, try to parse token from header if !hasAuth { authHeader := r.Header.Get("Authorization") if strings.HasPrefix(authHeader, "Bearer ") { @@ -81,7 +85,6 @@ func ReserveSlotHandler(w http.ResponseWriter, r *http.Request) { var err error userID, _, _, err = auth.VerifyToken(tokenString, r.Context()) if err != nil { - // Invalid token - treat as unauthenticated userID = "" } hasAuth = userID != ""