version: 1
id: auth_rules
title: Authorization Rules
sources:
  primary_server:
    path: api/server.ts
  middleware:
    path: api/middlewares/index.ts
  project_md:
    path: openspec/project.md
    lines: "65-69"
  legacy_app:
    path: api/app.ts

auth_model:
  current_state: simplified_admin_auth
  description: |
    管理端接口普遍加了 `adminAuth` 中间件，但 `adminAuth` 当前为放行实现，
    不校验 token、不区分用户身份。

roles:
  - id: public
    description: "无需鉴权的访问方（当前系统中也包含前台用户行为）。"
  - id: admin
    description: "管理端访问方（当前仅通过前端保存 token 来区分 UI 状态）。"

mechanisms:
  admin_login:
    endpoint: "POST /api/admin/login"
    returns:
      token:
        type: string
        fixed_value: "admin-token"
    enforcement:
      middleware: adminAuth
      effective: allow_all
      evidence:
        - api/controllers/adminController.ts:1
        - api/middlewares/index.ts:57

middlewares:
  adminAuth:
    file: api/middlewares/index.ts
    behavior: allow_all
    notes: "当前实现为 next() 直接放行；生产环境需替换为真实鉴权。"

route_policies:
  - id: admin_namespace
    match:
      path_prefix: /api/admin/
    intended_guard: adminAuth
    effective_guard: none
    notes: "server.ts 中几乎所有 /api/admin/* 路由均挂载 adminAuth。"

  - id: admin_login
    match:
      path: /api/admin/login
      methods: [POST]
    intended_guard: none
    effective_guard: none

  - id: admin_protected_non_admin_prefix
    match:
      routes:
        - path: /api/questions
          methods: [POST]
        - path: /api/questions/:id
          methods: [PUT, DELETE]
        - path: /api/questions/import
          methods: [POST]
        - path: /api/questions/export
          methods: [GET]
        - path: /questions/export
          methods: [GET]
        - path: /api/quiz/records
          methods: [GET]
    intended_guard: adminAuth
    effective_guard: none

legacy_routes:
  - id: auth_demo
    mount_path: /api/auth
    file: api/routes/auth.ts
    status: not_implemented
    notes: "register/login/logout 均为 TODO，占位路由。"

constraints:
  - id: admin_auth_is_not_enforced
    severity: high
    evidence:
      - api/middlewares/index.ts:57
      - openspec/project.md:68
    details: |
      `adminAuth` 当前不校验任何凭证，导致管理接口实际可被任何请求方访问。

  - id: admin_token_is_fixed
    severity: medium
    evidence:
      - api/controllers/adminController.ts:1
      - openspec/project.md:68
    details: |
      `/api/admin/login` 返回固定 token `admin-token`，不具备会话隔离与过期能力。

