From 3602de07009cad0c58b4c9aa1e4fa4fc0c557573 Mon Sep 17 00:00:00 2001
From: Bohdan Shulha <b.shulha@pm.me>
Date: Fri, 5 Jul 2024 17:02:55 +0200
Subject: [PATCH] fix: run node auth middleware before everything else

---
 api-nodes/Http/Middleware/AgentTokenAuth.php | 6 +++++-
 bootstrap/app.php                            | 4 ++++
 routes/api.php                               | 2 +-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/api-nodes/Http/Middleware/AgentTokenAuth.php b/api-nodes/Http/Middleware/AgentTokenAuth.php
index 9c0cb6d..fdd0031 100644
--- a/api-nodes/Http/Middleware/AgentTokenAuth.php
+++ b/api-nodes/Http/Middleware/AgentTokenAuth.php
@@ -24,9 +24,13 @@ public function handle(Request $request, Closure $next): Response
         $token = $request->header(self::AUTH_HEADER);
 
         if (!$token) {
+            if ($request->bearerToken()) {
+                return $next($request);
+            }
+
             return response()->json([
                 'message' => 'Unauthorized'
-            ], 401);
+            ], 403);
         }
 
         $node = Node::withoutGlobalScope(TeamScope::class)->with('team')->whereAgentToken($token)->firstOrFail();
diff --git a/bootstrap/app.php b/bootstrap/app.php
index ffb0b45..c4a8bc4 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -1,5 +1,6 @@
 <?php
 
+use ApiNodes\Http\Middleware\AgentTokenAuth;
 use App\Http\Middleware\HandleInertiaRequests;
 use App\Jobs\CheckAgentUpdates;
 use Illuminate\Console\Scheduling\Schedule;
@@ -21,6 +22,9 @@
         $middleware->trustProxies('*');
 
         $middleware
+            ->api(prepend: [
+                AgentTokenAuth::class,
+            ])
             ->web(append: [
                 HandleInertiaRequests::class,
                 AddLinkHeadersForPreloadedAssets::class,
diff --git a/routes/api.php b/routes/api.php
index a9d8a06..39ef222 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -7,7 +7,7 @@
 use App\Api\Controllers\ServiceController;
 use Illuminate\Support\Facades\Route;
 
-Route::group(['prefix' => '/_nodes/v1', 'middleware' => [AgentTokenAuth::class]], function () {
+Route::group(['prefix' => '/_nodes/v1'], function () {
     Route::group(['prefix' => '/events'], function () {
         Route::post('/started', [EventController::class, 'started']);
     });