fix(auth): optional JWT on /api/auth/config, central rate limiter passthrough, org list 403

- /api/auth/config returns oAuth availability and minimal config for guests,
  extended org config for authenticated users
- Rate limiter middleware returns passthrough when config section is missing (dev)
- GET /api/organizations no longer requires policy.isAllowed (JWT auth suffices)
- Migration handles null userId and works without MongoDB replica set (no transactions)
- Add integration test for org list endpoint

Author: PierreBrisorgueil

ERRORS.md

@@ -23,3 +23,4 @@ Use this file as a compact memory of recurring AI mistakes.
 - [2026-03-13] architecture: middleware using mongoose.model() directly -> use module's Service or Repository
 - [2026-03-13] tests: test file placed outside its module (e.g. lib/middlewares/tests/) -> tests belong in modules/{module}/tests/
 - [2026-03-13] docs: duplicate doc files covering the same topic (e.g. MIGRATION.md + MIGRATIONS.md) -> single file, no duplication
+- [2026-03-14] middleware: assuming config section exists in all environments (e.g. `config.rateLimit`) -> always handle missing config gracefully (passthrough/no-op); dev config often omits sections that only prod defines

lib/middlewares/rateLimiter.js

@@ -1,14 +1,24 @@
 /**
  * Centralized rate limiter middleware.
  * Reads named profiles from config.rateLimit and exports a limiter for each.
+ * When a profile is missing (e.g. in dev), returns a passthrough middleware.
  */
 import rateLimit from 'express-rate-limit';
 
 import config from '../../config/index.js';
 
-const limiters = {};
-for (const [name, opts] of Object.entries(config.rateLimit || {})) {
-  limiters[name] = rateLimit(opts);
-}
+const passthrough = (req, res, next) => next();
+
+const limiters = new Proxy({}, {
+  get(target, name) {
+    if (name in target) return target[name];
+    const opts = config.rateLimit?.[name];
+    if (opts) {
+      target[name] = rateLimit(opts);
+      return target[name];
+    }
+    return passthrough;
+  },
+});
 
 export default limiters;

modules/auth/controllers/auth.controller.js

@@ -370,23 +370,36 @@ const oauthCallback = async (req, res, next) => {
  * @param {Object} res - Express response object
  * @returns {void} Sends the public auth configuration in the HTTP response
  */
-const getConfig = (_req, res) => {
-  responses.success(res, 'Auth config')({
+const getConfig = (req, res) => {
+  const data = {
     sign: {
       in: !!config.sign.in,
       up: !!config.sign.up,
     },
+    oAuth: {
+      google: !!config.oAuth?.google?.clientID,
+      apple: !!config.oAuth?.apple?.clientID,
+    },
     organizations: {
       enabled: !!config.organizations?.enabled,
-      autoCreate: !!config.organizations?.autoCreate,
-      domainMatching: !!config.organizations?.domainMatching,
-      roles: config.organizations?.roles || [],
-      roleDescriptions: config.organizations?.roleDescriptions || {},
     },
     mail: {
       configured: isMailerConfigured(),
     },
-  });
+  };
+
+  // Authenticated users get extended org config
+  if (req.user) {
+    data.organizations = {
+      ...data.organizations,
+      autoCreate: !!config.organizations?.autoCreate,
+      domainMatching: !!config.organizations?.domainMatching,
+      roles: config.organizations?.roles || [],
+      roleDescriptions: config.organizations?.roleDescriptions || {},
+    };
+  }
+
+  responses.success(res, 'Auth config')(data);
 };
 
 /**

modules/auth/routes/auth.routes.js

@@ -16,8 +16,14 @@ import authPassword from '../controllers/auth.password.controller.js';
 export default (app) => {
   const authLimiter = limiters.auth;
 
-  // Public auth config (no authentication required, rate-limited)
-  app.route('/api/auth/config').get(authLimiter, auth.getConfig);
+  // Auth config — optional JWT: public fields for everyone, org details for authenticated users
+  const optionalJwt = (req, res, next) => {
+    passport.authenticate('jwt', { session: false }, (err, user) => {
+      if (user) req.user = user;
+      next();
+    })(req, res, next);
+  };
+  app.route('/api/auth/config').get(authLimiter, optionalJwt, auth.getConfig);
 
   // Setting up the users password api
   app.route('/api/auth/forgot').post(authLimiter, authPassword.forgot);

modules/organizations/migrations/20260310120000-organizations-init.js

@@ -22,13 +22,13 @@ export async function up() {
 
   // ── Step 1: Find users who don't have any membership yet ──────────
   const allMemberships = await Membership.find({}, 'userId').lean();
-  const usersWithOrganization = new Set(allMemberships.map((m) => m.userId.toString()));
+  const usersWithOrganization = new Set(allMemberships.filter((m) => m.userId).map((m) => m.userId.toString()));
   const usersWithoutOrganization = await User.find({
     _id: { $nin: [...usersWithOrganization] },
   }).lean();
 
   // ── Step 2: Create a default organization + owner membership per user
-  // Uses a session/transaction to prevent duplicate or orphaned orgs on retry
+  // No transactions — compatible with standalone MongoDB (no replica set required)
   for (const user of usersWithoutOrganization) {
     // Double-check: skip if a membership was created since the initial query
     const alreadyHas = await Membership.findOne({ userId: user._id }).lean();
@@ -37,32 +37,23 @@ export async function up() {
     const firstName = user.firstName || 'User';
     const lastName = user.lastName || '';
 
+    let organization;
     const maxRetries = 3;
     for (let attempt = 0; attempt < maxRetries; attempt += 1) {
       const slug = await generateOrganizationSlug(firstName, lastName);
-      const session = await mongoose.startSession();
       try {
-        await session.withTransaction(async () => {
-          const [organization] = await Organization.create(
-            [{ name: `${firstName}'s organization`, slug, createdBy: user._id }],
-            { session },
-          );
-
-          await Membership.create(
-            [{ userId: user._id, organizationId: organization._id, role: 'owner' }],
-            { session },
-          );
-
-          await User.updateOne({ _id: user._id }, { currentOrganization: organization._id }, { session });
-        });
+        organization = await Organization.create({ name: `${firstName}'s organization`, slug, createdBy: user._id });
         break; // Success — exit retry loop
       } catch (err) {
         if (err?.code === 11000 && attempt < maxRetries - 1) continue; // Slug collision — retry
         throw err;
-      } finally {
-        await session.endSession();
       }
     }
+
+    if (organization) {
+      await Membership.create({ userId: user._id, organizationId: organization._id, role: 'owner' });
+      await User.updateOne({ _id: user._id }, { currentOrganization: organization._id });
+    }
   }
 
   // ── Step 2b: Backfill currentOrganization for users who have a membership but no currentOrganization

modules/organizations/routes/organizations.routes.js

@@ -15,7 +15,7 @@ export default (app) => {
   // Organization CRUD
   app
     .route('/api/organizations')
-    .all(passport.authenticate('jwt', { session: false }), policy.isAllowed)
+    .all(passport.authenticate('jwt', { session: false }))
     .get(organizations.list)
     .post(policy.isAllowed, model.isValid(organizationsSchema.Organization), organizations.create);
 

modules/organizations/tests/organizations.integration.tests.js

@@ -0,0 +1,107 @@
+/**
+ * Module dependencies.
+ */
+import request from 'supertest';
+import path from 'path';
+
+import { bootstrap } from '../../../lib/app.js';
+import mongooseService from '../../../lib/services/mongoose.js';
+import config from '../../../config/index.js';
+
+/**
+ * Integration tests for organization routes.
+ * Verifies that authenticated users can access organization endpoints
+ * without receiving 403 errors.
+ */
+describe('Organizations integration tests:', () => {
+  let UserService;
+  let OrganizationsRepository;
+  let MembershipRepository;
+  let agent;
+
+  // Store original config
+  const originalOrganizations = { ...config.organizations };
+
+  /**
+   * @description Clean up a user and their associated organizations/memberships.
+   * @param {Object} user - The user object to clean up.
+   */
+  const cleanupUser = async (user) => {
+    if (!user) return;
+    try {
+      const memberships = await MembershipRepository.list({ userId: user.id || user._id });
+      for (const m of memberships) {
+        const orgId = m.organizationId._id || m.organizationId;
+        await MembershipRepository.deleteMany({ organizationId: orgId });
+        await OrganizationsRepository.deleteMany({ _id: orgId });
+      }
+      await UserService.remove(user);
+    } catch (_) { /* cleanup — ignore errors */ }
+  };
+
+  // init
+  beforeAll(async () => {
+    try {
+      const init = await bootstrap();
+      UserService = (await import(path.resolve('./modules/users/services/users.service.js'))).default;
+      OrganizationsRepository = (await import(path.resolve('./modules/organizations/repositories/organizations.repository.js'))).default;
+      MembershipRepository = (await import(path.resolve('./modules/organizations/repositories/organizations.membership.repository.js'))).default;
+      agent = request.agent(init.app);
+    } catch (err) {
+      console.log(err);
+      expect(err).toBeFalsy();
+    }
+  });
+
+  describe('GET /api/organizations', () => {
+    let user;
+
+    beforeAll(async () => {
+      config.organizations = { enabled: true, autoCreate: true, domainMatching: false };
+      try {
+        const result = await agent
+          .post('/api/auth/signup')
+          .send({
+            firstName: 'OrgList',
+            lastName: 'User',
+            email: 'orglist@test.com',
+            password: 'W@os.jsI$Aw3$0m3',
+            provider: 'local',
+          })
+          .expect(200);
+        user = result.body.user;
+      } catch (err) {
+        console.log(err);
+        expect(err).toBeFalsy();
+      }
+    });
+
+    test('should return 200 and an array for an authenticated user', async () => {
+      try {
+        const result = await agent.get('/api/organizations').expect(200);
+
+        expect(result.body.type).toBe('success');
+        expect(result.body.message).toBe('organization list');
+        expect(result.body.data).toBeInstanceOf(Array);
+      } catch (err) {
+        console.log(err);
+        expect(err).toBeFalsy();
+      }
+    });
+
+    afterAll(async () => {
+      await cleanupUser(user);
+    });
+  });
+
+  // Mongoose disconnect
+  afterAll(async () => {
+    config.organizations = { ...originalOrganizations };
+    try {
+      await mongooseService.disconnect();
+    } catch (err) {
+      console.log(err);
+      expect(err).toBeFalsy();
+    }
+  });
+});