SkyMoney/docs/api-phase8-move-log.md

API Phase 8 Move Log

Date: 2026-03-17
Scope: Move admin and site-access endpoints out of api/src/server.ts into dedicated route modules.

Route Registration Changes

• Added site-access route import in server.ts
• Added admin route import in server.ts
• Registered site-access routes in server.ts
• Registered admin routes in server.ts
• New canonical route modules:
  • site-access.ts
  • admin.ts
• Removed inline route blocks from server.ts to avoid duplicate registration:
  • GET /site-access/status
  • POST /site-access/unlock
  • POST /site-access/lock
  • POST /admin/rollover

Endpoint Movements

1. GET /site-access/status

• Original: server.ts line 946
• Moved to site-access.ts
• References:
  • siteAccess.ts
  • BetaGate.tsx
  • BetaAccessPage.tsx

2. POST /site-access/unlock

• Original: server.ts line 957
• Moved to site-access.ts
• References:
  • siteAccess.ts
  • BetaAccessPage.tsx

3. POST /site-access/lock

• Original: server.ts line 994
• Moved to site-access.ts
• References:
  • siteAccess.ts
  • BetaAccessPage.tsx

4. POST /admin/rollover

• Original: server.ts line 1045
• Moved to admin.ts
• References:
  • access-control.admin-rollover.test.ts

Helper Ownership in Phase 8

• Shared helper injection from server.ts:
  • authRateLimit
  • mutationRateLimit
  • hasSiteAccessBypass
  • safeEqual
  • isInternalClientIp
  • runtime config flags and cookie settings (UNDER_CONSTRUCTION, break-glass, cookie domain/secure, etc.)
• Route-local helpers/schemas:
  • site-access.ts: unlock payload schema
  • admin.ts: rollover payload schema
• Retained in server.ts by design for global hook behavior:
  • site-access bypass token derivation and onRequest maintenance-mode enforcement

Verification

1. Build

• cd api && npm run build ✅

2. Focused tests

• cd api && npm run test -- tests/access-control.admin-rollover.test.ts tests/security-misconfiguration.test.ts
• Result: blocked by local DB connectivity (127.0.0.1:5432 unavailable), suite skipped/failed before endpoint assertions.