Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug]: Logged-in participants are never linked to their account

Open
  • Is something wrong?
#158 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
70/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
express, typescript
Domain
api, authentication, backend

Research direction

Start with authMiddleware in apps/http-server/src/middlewares/authmiddleware.ts to see how the token is verified, then look at the POST /join route in apps/http-server/src/routes/session.ts and joinQuizController in sessionController.ts, which reads req.userId. Add an optional variant that sets req.userId only when a valid token is present and otherwise calls next(). Done when a signed-in join stores its userId, and anonymous and expired-token joins still succeed.

Written by the indexing model from the issue text.

Description

bug help wanted
What happened?

joinQuizController in apps/http-server/src/controllers/sessionController.ts
stores the participant's user id:

const participant = await tx.participant.create({
    data: {
        username,
        sessionId: session.id,
        userId: req.userId || null
    }
});

But the route has no authMiddleware:

apps/http-server/src/routes/session.ts:

router.post("/join", joinQuizController)

req.userId is only ever set by authMiddleware, so it is always
undefined here, and every participant row is written with userId: null —
including participants who are signed in.

Why it matters. planning.md promises that a registered user can see the
quizzes they participated in. getAllQuizesController cannot deliver that,
because nothing connects a Participant row to a User. The feature is
silently broken.

The tricky part. Joining must stay open to anonymous participants — that is
a core feature, no signup required to play. So this cannot simply have
authMiddleware bolted on, which would reject anonymous joins with a 401.

What is needed is optional authentication: attach req.userId when a valid
token is present, and continue without it otherwise.

Steps to reproduce

Suggested fix. Add an optionalAuth middleware next to the existing one in
apps/http-server/src/middlewares/authmiddleware.ts:

  • No Authorization header → call next() with no req.userId
  • Valid token → set req.userId, call next()
  • Malformed or expired token → also just next() without req.userId, so a
    stale token in someone's browser does not block them from joining a quiz

Then apply it to POST /join.

Definition of done:

  • A signed-in user who joins gets a Participant row with their userId
  • An anonymous user can still join with no token at all
  • An expired token does not prevent joining
  • Participation history works for registered users
Which part of Rexial?

http-server (Express REST API)

How are you running Rexial?

Docker Compose (docker-compose up)

Logs or error output
Environment

No response

Before submitting
  • I searched existing issues and this has not been reported
  • I am not including any secrets, API keys or passwords in this report
Dominant language
TypeScript
Stars
21
Forks
7
Avg merge
3h 39m
Merged PRs (30d)
16

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from TheCodeHeist-Coder/Rexial

All issues in TheCodeHeist-Coder/Rexial

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.