Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

[Bug]: Logged-in participants are never linked to their account

Offen
  • Stimmt etwas nicht?
#158 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
Ein halber Tag
Anfängerfreundlichkeit
70/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
express, typescript
Bereich
api, authentication, backend

Rechercherichtung

Start with authMiddleware in apps/http-server/src/middlewares/authmiddleware.ts to see how the token is verified, then look at the POST /join route in apps/http-server/src/routes/session.ts and joinQuizController in sessionController.ts, which reads req.userId. Add an optional variant that sets req.userId only when a valid token is present and otherwise calls next(). Done when a signed-in join stores its userId, and anonymous and expired-token joins still succeed.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

bug help wanted
What happened?

joinQuizController in apps/http-server/src/controllers/sessionController.ts
stores the participant's user id:

const participant = await tx.participant.create({
    data: {
        username,
        sessionId: session.id,
        userId: req.userId || null
    }
});

But the route has no authMiddleware:

apps/http-server/src/routes/session.ts:

router.post("/join", joinQuizController)

req.userId is only ever set by authMiddleware, so it is always
undefined here, and every participant row is written with userId: null —
including participants who are signed in.

Why it matters. planning.md promises that a registered user can see the
quizzes they participated in. getAllQuizesController cannot deliver that,
because nothing connects a Participant row to a User. The feature is
silently broken.

The tricky part. Joining must stay open to anonymous participants — that is
a core feature, no signup required to play. So this cannot simply have
authMiddleware bolted on, which would reject anonymous joins with a 401.

What is needed is optional authentication: attach req.userId when a valid
token is present, and continue without it otherwise.

Steps to reproduce

Suggested fix. Add an optionalAuth middleware next to the existing one in
apps/http-server/src/middlewares/authmiddleware.ts:

  • No Authorization header → call next() with no req.userId
  • Valid token → set req.userId, call next()
  • Malformed or expired token → also just next() without req.userId, so a
    stale token in someone's browser does not block them from joining a quiz

Then apply it to POST /join.

Definition of done:

  • A signed-in user who joins gets a Participant row with their userId
  • An anonymous user can still join with no token at all
  • An expired token does not prevent joining
  • Participation history works for registered users
Which part of Rexial?

http-server (Express REST API)

How are you running Rexial?

Docker Compose (docker-compose up)

Logs or error output
Environment

No response

Before submitting
  • I searched existing issues and this has not been reported
  • I am not including any secrets, API keys or passwords in this report
Vorherrschende Sprache
TypeScript
Sterne
21
Forks
7
Ø Merge
3 Std. 39 Min.
Gemergte PRs (30 T.)
16

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus TheCodeHeist-Coder/Rexial

Alle Issues in TheCodeHeist-Coder/Rexial

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.