go-chi-global-auth-middleware-skip-paths

Answer

The root cause: the OpenAPI spec declares /api/v1/openapi.yaml with security: [] (public), but two global middleware layers (SessionValidator + BearerAuth) run before routing and 401 every request not on their skip lists. Additionally, the router mounts the same handler tree at both /api/v1 and /v1, so a skip entry for only one prefix still 401s the other mount. Fix both middleware files, adding the public spec path under both prefixes.

1. session_middleware.go — extend DefaultSessionValidatorConfig

// session_middleware.go
type SessionValidatorConfig struct {
    // SkipPaths are exact request paths that bypass session validation.
    SkipPaths []string
    // ...other config fields
}

// DefaultSessionValidatorConfig is the baseline config applied to all
// non-skipped routes. Keep public spec endpoints (security: [] in the
// OpenAPI spec) on this list — for BOTH router mounts (/api/v1 and /v1).
var DefaultSessionValidatorConfig = SessionValidatorConfig{
    SkipPaths: []string{
        // public spec endpoints — /api/v1 mount
        "/api/v1/openapi.yaml",
        "/api/v1/health",
        // public spec endpoints — /v1 mount (second mount of same tree)
        "/v1/openapi.yaml",
        "/v1/health",
    },
}

The middleware itself must consult this list before rejecting (typically unchanged, but shown for context):

func SessionValidator(cfg SessionValidatorConfig) func(http.Handler) http.Handler {
    skipped := make(map[string]struct{}, len(cfg.SkipPaths))
    for _, p := range cfg.SkipPaths {
        skipped[p] = struct{}{}
    }
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            if _, ok := skipped[r.URL.Path]; ok {
                next.ServeHTTP(w, r) // public: skip session validation
                return
            }
            // ...existing session cookie validation → 401 on failure
        })
    }
}

2. api/middleware/auth.go — extend BearerAuth skipPaths

// api/middleware/auth.go
// skipPaths are routes declared public (security: []) in the OpenAPI spec.
// Entries must cover BOTH mounts: /api/v1 and /v1.
var skipPaths = []string{
    "/api/v1/openapi.yaml",
    "/v1/openapi.yaml",
    "/api/v1/health",
    "/v1/health",
}

func isSkipped(path string) bool {
    for _, s := range skipPaths {
        if s == path {
            return true
        }
    }
    return false
}

func BearerAuth(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if isSkipped(r.URL.Path) {
            next.ServeHTTP(w, r) // public: no bearer token required
            return
        }
        // ...existing token parsing/validation → 401 on failure
    })
}

3. Regression tests (assert skip works and protected routes still 401)

// session_middleware_test.go
func TestSessionValidator_SkipPathsCoverBothMounts(t *testing.T) {
    for _, p := range []string{"/api/v1/openapi.yaml", "/v1/openapi.yaml"} {
        if !slices.Contains(DefaultSessionValidatorConfig.SkipPaths, p) {
            t.Errorf("DefaultSessionValidatorConfig.SkipPaths missing %q", p)
        }
    }
}

func TestSessionValidator_PublicSpecServed(t *testing.T) {
    r := chi.NewRouter()
    r.Use(SessionValidator(DefaultSessionValidatorConfig))
    // same handler tree mounted twice — the GAP-004 setup
    r.Mount("/api/v1", openAPIHandler())
    r.Mount("/v1", openAPIHandler())

    for _, path := range []string{"/api/v1/openapi.yaml", "/v1/openapi.yaml"} {
        req := httptest.NewRequest(http.MethodGet, path, nil) // NO session cookie
        rec := httptest.NewRecorder()
        r.ServeHTTP(rec, req)
        if rec.Code != http.StatusOK {
            t.Errorf("%s: want 200, got %d", path, rec.Code)
        }
    }
}

func TestSessionValidator_ProtectedRouteStill401(t *testing.T) {
    r := chi.NewRouter()
    r.Use(SessionValidator(DefaultSessionValidatorConfig))
    r.Get("/api/v1/users", func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(200) })

    req := httptest.NewRequest(http.MethodGet, "/api/v1/users", nil) // no session
    rec := httptest.NewRecorder()
    r.ServeHTTP(rec, req)
    if rec.Code != http.StatusUnauthorized {
        t.Errorf("protected route: want 401, got %d", rec.Code)
    }
}

// api/middleware/auth_test.go
func TestBearerAuth_SkipPathsCoverBothMounts(t *testing.T) {
    for _, p := range []string{"/api/v1/openapi.yaml", "/v1/openapi.yaml"} {
        if !slices.Contains(skipPaths, p) {
            t.Errorf("BearerAuth skipPaths missing %q", p)
        }
    }
}

func TestBearerAuth_PublicSpecServed(t *testing.T) {
    h := BearerAuth(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
        w.WriteHeader(http.StatusOK)
    }))
    for _, path := range []string{"/api/v1/openapi.yaml", "/v1/openapi.yaml"} {
        req := httptest.NewRequest(http.MethodGet, path, nil) // NO Authorization header
        rec := httptest.NewRecorder()
        h.ServeHTTP(rec, req)
        if rec.Code != http.StatusOK {
            t.Errorf("%s: want 200, got %d", path, rec.Code)
        }
    }
}

func TestBearerAuth_ProtectedRouteStill401(t *testing.T) {
    h := BearerAuth(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {}))
    req := httptest.NewRequest(http.MethodGet, "/api/v1/users", nil) // no token
    rec := httptest.NewRecorder()
    h.ServeHTTP(rec, req)
    if rec.Code != http.StatusUnauthorized {
        t.Errorf("protected route: want 401, got %d", rec.Code)
    }
}

Key correctness points: - Skip checks use r.URL.Path (exact match) so /api/v1/openapi.yaml?x=1 and /v1/openapi.yaml both match; /api/v1/openapi.yaml/evil does not accidentally become public. - Both prefix variants are added because chi's Mount passes the mount path through to the global middleware's request path — a single /api/v1 entry leaves the /v1 mount 401ing. - Skip only bypasses auth, it never changes handler semantics: the spec handler still runs, so responses remain consistent.