Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[Bug]: Logged-in participants are never linked to their account

オープン
  • 何か問題がありますか？
#158 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
半日
初心者へのやさしさ
70/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
express, typescript
領域
api, authentication, backend

調査の方向性

Start with authMiddleware in apps/http-server/src/middlewares/authmiddleware.ts to see how the token is verified, then look at the POST /join route in apps/http-server/src/routes/session.ts and joinQuizController in sessionController.ts, which reads req.userId. Add an optional variant that sets req.userId only when a valid token is present and otherwise calls next(). Done when a signed-in join stores its userId, and anonymous and expired-token joins still succeed.

索引モデルが issue の本文から書いたものです。

説明

bug help wanted
What happened?

joinQuizController in apps/http-server/src/controllers/sessionController.ts
stores the participant's user id:

const participant = await tx.participant.create({
    data: {
        username,
        sessionId: session.id,
        userId: req.userId || null
    }
});

But the route has no authMiddleware:

apps/http-server/src/routes/session.ts:

router.post("/join", joinQuizController)

req.userId is only ever set by authMiddleware, so it is always
undefined here, and every participant row is written with userId: null —
including participants who are signed in.

Why it matters. planning.md promises that a registered user can see the
quizzes they participated in. getAllQuizesController cannot deliver that,
because nothing connects a Participant row to a User. The feature is
silently broken.

The tricky part. Joining must stay open to anonymous participants — that is
a core feature, no signup required to play. So this cannot simply have
authMiddleware bolted on, which would reject anonymous joins with a 401.

What is needed is optional authentication: attach req.userId when a valid
token is present, and continue without it otherwise.

Steps to reproduce

Suggested fix. Add an optionalAuth middleware next to the existing one in
apps/http-server/src/middlewares/authmiddleware.ts:

  • No Authorization header → call next() with no req.userId
  • Valid token → set req.userId, call next()
  • Malformed or expired token → also just next() without req.userId, so a
    stale token in someone's browser does not block them from joining a quiz

Then apply it to POST /join.

Definition of done:

  • A signed-in user who joins gets a Participant row with their userId
  • An anonymous user can still join with no token at all
  • An expired token does not prevent joining
  • Participation history works for registered users
Which part of Rexial?

http-server (Express REST API)

How are you running Rexial?

Docker Compose (docker-compose up)

Logs or error output
Environment

No response

Before submitting
  • I searched existing issues and this has not been reported
  • I am not including any secrets, API keys or passwords in this report
主要言語
TypeScript
スター
21
フォーク
7
平均マージ
4時間 31分
マージ済み PR（30日）
22

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

TheCodeHeist-Coder/Rexial のほかの issue

TheCodeHeist-Coder/Rexial の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。