From c23259154d3defab98216d704020d486f1f76613 Mon Sep 17 00:00:00 2001
From: Jan-Hendrik Willms <tleilax+studip@gmail.com>
Date: Fri, 11 Jul 2025 10:53:24 +0200
Subject: jsonapi: register routes as middleware after potential
 authentication, fixes #5681

Closes #5681

Merge request studip/studip!4319
---
 lib/classes/JsonApi/routes.php                     |  8 -------
 lib/middleware/JsonApiRouteRegistrarMiddleware.php | 25 ++++++++++++++++++++++
 public/jsonapi.php                                 | 13 ++++++-----
 3 files changed, 31 insertions(+), 15 deletions(-)
 delete mode 100644 lib/classes/JsonApi/routes.php
 create mode 100644 lib/middleware/JsonApiRouteRegistrarMiddleware.php

diff --git a/lib/classes/JsonApi/routes.php b/lib/classes/JsonApi/routes.php
deleted file mode 100644
index 5132f55..0000000
--- a/lib/classes/JsonApi/routes.php
+++ /dev/null
@@ -1,8 +0,0 @@
-<?php
-namespace JsonApi;
-
-use Slim\App;
-
-return function (App $app) {
-    $app->group('/v1', RouteMap::class);
-};
diff --git a/lib/middleware/JsonApiRouteRegistrarMiddleware.php b/lib/middleware/JsonApiRouteRegistrarMiddleware.php
new file mode 100644
index 0000000..92f178e
--- /dev/null
+++ b/lib/middleware/JsonApiRouteRegistrarMiddleware.php
@@ -0,0 +1,25 @@
+<?php
+namespace Studip\Middleware;
+
+use JsonApi\RouteMap;
+use Psr\Http\Message\{
+    ResponseInterface as Response,
+    ServerRequestInterface as Request
+};
+use Psr\Http\Server\MiddlewareInterface;
+use Psr\Http\Server\RequestHandlerInterface;
+
+final class JsonApiRouteRegistrarMiddleware implements MiddlewareInterface
+{
+    public function __construct(
+        private readonly \Slim\App $app
+    ) {
+    }
+
+    public function process(Request $request, RequestHandlerInterface $handler): Response
+    {
+        $this->app->group('/v1', RouteMap::class);
+
+        return $handler->handle($request);
+    }
+}
diff --git a/public/jsonapi.php b/public/jsonapi.php
index 8d69b51..392b8b0 100644
--- a/public/jsonapi.php
+++ b/public/jsonapi.php
@@ -2,7 +2,7 @@
 
 use Slim\Factory\AppFactory;
 
-require '../lib/bootstrap.php';
+require __DIR__ . '/../lib/bootstrap.php';
 
 \StudipAutoloader::addAutoloadPath($GLOBALS['STUDIP_BASE_PATH'] . DIRECTORY_SEPARATOR . 'vendor/oauth-php/library/');
 
@@ -22,14 +22,13 @@ $app->setBasePath($GLOBALS['CANONICAL_RELATIVE_PATH_STUDIP'] . 'jsonapi.php');
 $middleware = require 'lib/classes/JsonApi/middleware.php';
 $middleware($app);
 
+// Register routes via middleware
+$app->add(Studip\Middleware\JsonApiRouteRegistrarMiddleware::class);
+
 //register stud.ip session/auth middleware
-$app->add(app(Studip\Middleware\AuthenticationMiddleware::class));
+$app->add(Studip\Middleware\AuthenticationMiddleware::class);
 auth()->setNobody(true);
-$app->add(app(Studip\Middleware\SessionMiddleware::class));
-
-// Register routes
-$routes = require 'lib/classes/JsonApi/routes.php';
-$routes($app);
+$app->add(Studip\Middleware\SessionMiddleware::class);
 
 // Add Error Middleware
 $displayErrors = false;
-- 
cgit v1.0