setupEndpoints make the endpoint secure?

[osseonews]

I was trying to create a plugin and in looking at the current plugins, I see they set up an API endpoint with the setupEndpoints method. But, then none of the plugins actually secure the API endpoint with admin.express.authorize? Does the setupEndpoints add the authorization automatically?

[yaroslav8765]

Hi! When you are registering new endpoint inside plugin, you can make it private/public by changing noAuth props like here:

  server.endpoint({
    method: 'POST',
    path: `/plugin/passkeys/checkIfUserHasPasskeys`,
    noAuth: true,
    handler: async ({ cookies }) => handlers.checkIfUserHasPasskeys({ cookies }),
  });

noAuth: true - allow public access
noAuth: false - forbid public access

And inside of adminforth we are register these endpoints based on this prop like:

this.expressApp[method.toLowerCase()](fullPath, noAuth ? expressHandler : this.authorize(expressHandler));

this.authorize - adds user verification before every api.

Here is the source code: https://github.com/devforth/adminforth/blob/main/adminforth/servers/express.ts

[osseonews]

Thanks! And from what I can tell the default if you don't pass in anything is false? so basically, you kind of have to opt in to a non-secure endpoint?

[yaroslav8765]

Yes, by default noAuth: false (access allowed only logged-in users) and if you want to make endpoint public, then set noAuth: true