Resolves issue-#7437

Author: Rakshak05

app/api/architecture/route.ts

@@ -9,13 +9,10 @@ import pLimit from 'p-limit';
 import { cloneGitHubRepository } from '@/lib/git-clone';
 import { getGitHubTokens } from '@/lib/github';
 import { formatRepoRefForLogging, sanitizeErrorForLogging } from '@/lib/sanitize-git-credentials';
-import { auth } from '@/auth';
 import { getClientIp } from '@/utils/getClientIp';
 
 const execFilePromise = promisify(execFile);
 
-const REST_TIMEOUT_MS = 5000; // 5s timeout for external API requests
-
 // Per-IP concurrent clone tracking (max 3 concurrent clones per IP)
 const MAX_CONCURRENT_CLONES_PER_IP = 3;
 const MAX_TEMP_DIR_SIZE_BYTES = 500 * 1024 * 1024; // 500MB
@@ -310,12 +307,6 @@ export async function POST(req: NextRequest) {
   let tempDir = '';
   const ip = getClientIp(req);
 
-  // Require authenticated session
-  const session = await auth();
-  if (!session?.user) {
-    return NextResponse.json({ error: 'Authentication required' }, { status: 401 });
-  }
-
   // Check concurrent clone limit per IP
   if (!incrementClones(ip)) {
     return NextResponse.json(

app/api/enterprise/route.ts

@@ -1,6 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { aggregateTeamData } from '@/lib/analytics/teamHealth';
-import { requireEnterpriseAdmin } from '@/lib/enterprise-auth';
 import type { TeamMember } from '@/types/enterprise';
 import type { ContributionCalendar } from '@/types';
 
@@ -35,9 +34,6 @@ function createMockTeamMembers(usernames: string[]): TeamMember[] {
 }
 
 export async function GET(request: NextRequest) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const searchParams = request.nextUrl.searchParams;
   const teamId = searchParams.get('teamId') || 'default-team';
   const teamName = searchParams.get('teamName') || 'Engineering Team';
@@ -74,9 +70,6 @@ export async function GET(request: NextRequest) {
 }
 
 export async function POST(request: NextRequest) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   let body: Record<string, unknown>;
   try {
     body = await request.json();

app/api/enterprise/teams/[teamId]/route.ts

@@ -1,13 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { requireEnterpriseAdmin } from '@/lib/enterprise-auth';
 
 export async function PATCH(
   _request: NextRequest,
   { params }: { params: Promise<{ teamId: string }> }
 ) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const { teamId } = await params;
 
   if (!teamId) {
@@ -24,9 +20,6 @@ export async function DELETE(
   _request: NextRequest,
   { params }: { params: Promise<{ teamId: string }> }
 ) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const { teamId } = await params;
 
   if (!teamId) {

app/api/enterprise/teams/route.ts

@@ -1,12 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { requireEnterpriseAdmin } from '@/lib/enterprise-auth';
 
 const mockTeams: Record<string, { id: string; name: string; members: string[] }> = {};
 
 export async function GET() {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const teams = Object.values(mockTeams);
 
   return NextResponse.json({
@@ -16,9 +12,6 @@ export async function GET() {
 }
 
 export async function POST(request: NextRequest) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   let body: { name?: string; members?: string[] };
   try {
     body = await request.json();

middleware.auth.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { NextRequest, NextResponse } from 'next/server';
+import { middleware } from './middleware';
+import { auth } from './auth';
+import type { Session } from 'next-auth';
+
+vi.mock('./lib/rate-limit', () => ({
+  rateLimit: vi.fn().mockResolvedValue({
+    success: true,
+    limit: 60,
+    remaining: 59,
+    reset: 123456789,
+  }),
+  getRateLimitHeaders: vi.fn(() => ({})),
+}));
+
+vi.mock('./auth', () => ({
+  auth: vi.fn(),
+}));
+
+describe('middleware auth and authorization', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.stubEnv('ENTERPRISE_ADMIN_GITHUB_IDS', '');
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('unauthenticated request to /api/enterprise/teams returns 401', async () => {
+    vi.mocked(auth).mockResolvedValue(null);
+
+    const request = new NextRequest('http://localhost:3000/api/enterprise/teams');
+    const response = await middleware(request);
+
+    expect(response.status).toBe(401);
+    const body = await response.json();
+    expect(body).toEqual({ error: 'Authentication required' });
+    expect(response.headers.get('X-Frame-Options')).toBe('DENY');
+  });
+
+  it('authenticated request to /api/enterprise/teams returns 503 if ENTERPRISE_ADMIN_GITHUB_IDS is empty', async () => {
+    vi.mocked(auth).mockResolvedValue({ user: { id: 'user123' } } as unknown as Session);
+    vi.stubEnv('ENTERPRISE_ADMIN_GITHUB_IDS', '');
+
+    const request = new NextRequest('http://localhost:3000/api/enterprise/teams');
+    const response = await middleware(request);
+
+    expect(response.status).toBe(503);
+    const body = await response.json();
+    expect(body).toEqual({ error: 'Enterprise admin access not configured' });
+  });
+
+  it('authenticated request to /api/enterprise/teams returns 403 if user is not an enterprise admin', async () => {
+    vi.mocked(auth).mockResolvedValue({ user: { id: 'user123' } } as unknown as Session);
+    vi.stubEnv('ENTERPRISE_ADMIN_GITHUB_IDS', 'admin1,admin2');
+
+    const request = new NextRequest('http://localhost:3000/api/enterprise/teams');
+    const response = await middleware(request);
+
+    expect(response.status).toBe(403);
+    const body = await response.json();
+    expect(body).toEqual({ error: 'Forbidden: enterprise admin access required' });
+  });
+
+  it('authenticated request to /api/enterprise/teams passes if user is an enterprise admin', async () => {
+    vi.mocked(auth).mockResolvedValue({ user: { id: 'admin1' } } as unknown as Session);
+    vi.stubEnv('ENTERPRISE_ADMIN_GITHUB_IDS', 'admin1,admin2');
+    const nextSpy = vi.spyOn(NextResponse, 'next');
+
+    const request = new NextRequest('http://localhost:3000/api/enterprise/teams');
+    const response = await middleware(request);
+
+    expect(nextSpy).toHaveBeenCalled();
+    expect(response.headers.get('X-Frame-Options')).toBe('DENY');
+  });
+
+  it('unauthenticated request to /api/architecture returns 401', async () => {
+    vi.mocked(auth).mockResolvedValue(null);
+
+    const request = new NextRequest('http://localhost:3000/api/architecture');
+    const response = await middleware(request);
+
+    expect(response.status).toBe(401);
+  });
+
+  it('authenticated request to /api/architecture passes', async () => {
+    vi.mocked(auth).mockResolvedValue({ user: { id: 'user123' } } as unknown as Session);
+    const nextSpy = vi.spyOn(NextResponse, 'next');
+
+    const request = new NextRequest('http://localhost:3000/api/architecture');
+    await middleware(request);
+
+    expect(nextSpy).toHaveBeenCalled();
+  });
+
+  it('unauthenticated request to /api/streak passes', async () => {
+    vi.mocked(auth).mockResolvedValue(null);
+    const nextSpy = vi.spyOn(NextResponse, 'next');
+
+    const request = new NextRequest('http://localhost:3000/api/streak?user=octocat');
+    await middleware(request);
+
+    expect(nextSpy).toHaveBeenCalled();
+    expect(auth).not.toHaveBeenCalled();
+  });
+});