Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

[Bug]: Logged-in participants are never linked to their account

Ouverte
  • Quelque chose ne va pas ?
#158 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
Une demi-journée
Accessibilité débutants
70/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
express, typescript
Domaine
api, authentication, backend

Piste de recherche

Start with authMiddleware in apps/http-server/src/middlewares/authmiddleware.ts to see how the token is verified, then look at the POST /join route in apps/http-server/src/routes/session.ts and joinQuizController in sessionController.ts, which reads req.userId. Add an optional variant that sets req.userId only when a valid token is present and otherwise calls next(). Done when a signed-in join stores its userId, and anonymous and expired-token joins still succeed.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

bug help wanted
What happened?

joinQuizController in apps/http-server/src/controllers/sessionController.ts
stores the participant's user id:

const participant = await tx.participant.create({
    data: {
        username,
        sessionId: session.id,
        userId: req.userId || null
    }
});

But the route has no authMiddleware:

apps/http-server/src/routes/session.ts:

router.post("/join", joinQuizController)

req.userId is only ever set by authMiddleware, so it is always
undefined here, and every participant row is written with userId: null —
including participants who are signed in.

Why it matters. planning.md promises that a registered user can see the
quizzes they participated in. getAllQuizesController cannot deliver that,
because nothing connects a Participant row to a User. The feature is
silently broken.

The tricky part. Joining must stay open to anonymous participants — that is
a core feature, no signup required to play. So this cannot simply have
authMiddleware bolted on, which would reject anonymous joins with a 401.

What is needed is optional authentication: attach req.userId when a valid
token is present, and continue without it otherwise.

Steps to reproduce

Suggested fix. Add an optionalAuth middleware next to the existing one in
apps/http-server/src/middlewares/authmiddleware.ts:

  • No Authorization header → call next() with no req.userId
  • Valid token → set req.userId, call next()
  • Malformed or expired token → also just next() without req.userId, so a
    stale token in someone's browser does not block them from joining a quiz

Then apply it to POST /join.

Definition of done:

  • A signed-in user who joins gets a Participant row with their userId
  • An anonymous user can still join with no token at all
  • An expired token does not prevent joining
  • Participation history works for registered users
Which part of Rexial?

http-server (Express REST API)

How are you running Rexial?

Docker Compose (docker-compose up)

Logs or error output
Environment

No response

Before submitting
  • I searched existing issues and this has not been reported
  • I am not including any secrets, API keys or passwords in this report
Langage dominant
TypeScript
Étoiles
21
Forks
7
Merge moyen
4 h 13 min
PR mergées (30 j)
20

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de TheCodeHeist-Coder/Rexial

Toutes les issues de TheCodeHeist-Coder/Rexial

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.