fix(auth): закрыть обход JWT через закодированные URL

backend/src/index.ts

@@ -5,7 +5,7 @@ import { monitorEventLoopDelay } from "node:perf_hooks"
 import { env } from "./config.js"
 import { initDatabase } from "./db/bootstrap.js"
 import { closePool } from "./db/index.js"
-import authPlugin, { requireAuth } from "./plugins/auth.js"
+import authPlugin, { requireApiAuth } from "./plugins/auth.js"
 import { installDatabaseRequestGate } from "./plugins/database-request-gate.js"
 import serversRoutes from "./routes/servers.js"
 import bgpRoutes from "./routes/bgp.js"
@@ -108,13 +108,7 @@ export async function buildApp(opts?: {
   }))
 
   if (env.authRequired) {
-    app.addHook("preHandler", async (request, reply) => {
-      const pathname = request.url.split("?")[0] ?? request.url
-      if (!pathname.startsWith("/api/")) return
-      if (pathname === "/api/auth/config") return
-      await requireAuth(request, reply)
-      if (reply.sent) return
-    })
+    app.addHook("preHandler", requireApiAuth)
   }
 
   installDatabaseRequestGate(app)