Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug]: Logged-in participants are never linked to their account

Abierto
  • ¿Algo no está bien?
#158 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
70/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
express, typescript
Área
api, authentication, backend

Línea de trabajo

Start with authMiddleware in apps/http-server/src/middlewares/authmiddleware.ts to see how the token is verified, then look at the POST /join route in apps/http-server/src/routes/session.ts and joinQuizController in sessionController.ts, which reads req.userId. Add an optional variant that sets req.userId only when a valid token is present and otherwise calls next(). Done when a signed-in join stores its userId, and anonymous and expired-token joins still succeed.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug help wanted
What happened?

joinQuizController in apps/http-server/src/controllers/sessionController.ts
stores the participant's user id:

const participant = await tx.participant.create({
    data: {
        username,
        sessionId: session.id,
        userId: req.userId || null
    }
});

But the route has no authMiddleware:

apps/http-server/src/routes/session.ts:

router.post("/join", joinQuizController)

req.userId is only ever set by authMiddleware, so it is always
undefined here, and every participant row is written with userId: null —
including participants who are signed in.

Why it matters. planning.md promises that a registered user can see the
quizzes they participated in. getAllQuizesController cannot deliver that,
because nothing connects a Participant row to a User. The feature is
silently broken.

The tricky part. Joining must stay open to anonymous participants — that is
a core feature, no signup required to play. So this cannot simply have
authMiddleware bolted on, which would reject anonymous joins with a 401.

What is needed is optional authentication: attach req.userId when a valid
token is present, and continue without it otherwise.

Steps to reproduce

Suggested fix. Add an optionalAuth middleware next to the existing one in
apps/http-server/src/middlewares/authmiddleware.ts:

  • No Authorization header → call next() with no req.userId
  • Valid token → set req.userId, call next()
  • Malformed or expired token → also just next() without req.userId, so a
    stale token in someone's browser does not block them from joining a quiz

Then apply it to POST /join.

Definition of done:

  • A signed-in user who joins gets a Participant row with their userId
  • An anonymous user can still join with no token at all
  • An expired token does not prevent joining
  • Participation history works for registered users
Which part of Rexial?

http-server (Express REST API)

How are you running Rexial?

Docker Compose (docker-compose up)

Logs or error output
Environment

No response

Before submitting
  • I searched existing issues and this has not been reported
  • I am not including any secrets, API keys or passwords in this report
Lenguaje dominante
TypeScript
Estrellas
21
Forks
7
Merge medio
4 h 31 min
PR fusionados (30 d)
22

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de TheCodeHeist-Coder/Rexial

Todos los issues de TheCodeHeist-Coder/Rexial

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.