fix: Add login check on /download-schema route (#4222)

theopensystemslab · Jan 29, 2025 · b567663 · b567663
1 parent 9227ee2
commit b567663
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/api.planx.uk/modules/flows/docs.yaml b/api.planx.uk/modules/flows/docs.yaml
@@ -273,6 +273,8 @@ paths:
       summary: Download flow schema
       description: Download a CSV file representing the flow's schema
       tags: ["flows"]
+      security:
+        - bearerAuth: []
       parameters:
         - $ref: "#/components/parameters/flowId"
       responses:

diff --git a/api.planx.uk/modules/flows/routes.ts b/api.planx.uk/modules/flows/routes.ts
@@ -1,6 +1,10 @@
 import { Router } from "express";
 import { validate } from "../../shared/middleware/validate.js";
-import { usePlatformAdminAuth, useTeamEditorAuth } from "../auth/middleware.js";
+import {
+  useLoginAuth,
+  usePlatformAdminAuth,
+  useTeamEditorAuth,
+} from "../auth/middleware.js";
 import { copyFlowController, copyFlowSchema } from "./copyFlow/controller.js";
 import {
   copyFlowAsPortalSchema,
@@ -73,6 +77,7 @@ router.post(
 
 router.get(
   "/flows/:flowId/download-schema",
+  useLoginAuth,
   validate(downloadFlowSchema),
   downloadFlowSchemaController,
 );