From 9c1a2f9c3709ce59271ea77cfd7b9af2a5e3d92a Mon Sep 17 00:00:00 2001
From: Nate Kelley <nate@buster.so>
Date: Thu, 11 Sep 2025 09:57:16 -0600
Subject: [PATCH] Require auth for github endpoints

---
 apps/server/src/api/v2/datasets/index.ts                  | 6 ++++--
 apps/server/src/api/v2/github/index.ts                    | 1 +
 .../server/src/api/v2/users/[id]/suggested-prompts/GET.ts | 8 +++++---
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/api/v2/datasets/index.ts b/apps/server/src/api/v2/datasets/index.ts
index 06e6889e9..8ac87294d 100644
--- a/apps/server/src/api/v2/datasets/index.ts
+++ b/apps/server/src/api/v2/datasets/index.ts
@@ -13,10 +13,12 @@ const app = new Hono<{
   Variables: {
     busterUser: User;
   };
-}>();
+}>()
+  // Apply authentication middleware to all routes
+  .use('*', requireAuth);
 
 // Get organization datasets endpoint
-app.get('/', requireAuth, async (c) => {
+app.get('/', async (c) => {
   const user = c.get('busterUser');
   const dataSourceId = c.req.query('dataSourceId');
 
diff --git a/apps/server/src/api/v2/github/index.ts b/apps/server/src/api/v2/github/index.ts
index 8279936e2..ef74e308f 100644
--- a/apps/server/src/api/v2/github/index.ts
+++ b/apps/server/src/api/v2/github/index.ts
@@ -34,6 +34,7 @@ const app = new Hono()
     return c.json(response);
   })
 
+  // OAuth callback - no auth needed since GitHub redirects here
   .get('/auth/callback', zValidator('query', AuthCallbackSchema), async (c) => {
     const query = c.req.valid('query');
     const result = await authCallbackHandler({
diff --git a/apps/server/src/api/v2/users/[id]/suggested-prompts/GET.ts b/apps/server/src/api/v2/users/[id]/suggested-prompts/GET.ts
index 7ae939a4d..654b82234 100644
--- a/apps/server/src/api/v2/users/[id]/suggested-prompts/GET.ts
+++ b/apps/server/src/api/v2/users/[id]/suggested-prompts/GET.ts
@@ -42,17 +42,19 @@ const app = new Hono().get(
           today.getFullYear() === updatedDate.getFullYear() &&
           today.getMonth() === updatedDate.getMonth() &&
           today.getDate() === updatedDate.getDate();
-          
+
         if (isToday) {
           return c.json(currentSuggestedPrompts);
         }
       }
 
       const timeoutMs = 10000; // 10 seconds timeout
-  
+
       const timeoutPromise = new Promise<never>((_, reject) => {
         setTimeout(() => {
-          reject(new Error('Request timeout after 10 seconds. Returning current suggested prompts.'));
+          reject(
+            new Error('Request timeout after 10 seconds. Returning current suggested prompts.')
+          );
         }, timeoutMs);
       });