📌 Description
src/middleware/maintenanceMode.ts exposes a maintenanceMode(enabled) middleware factory, but nothing in src/app.ts/src/routes currently lets an operator flip it without a redeploy. Add an authenticated toggle endpoint.
🧩 Requirements and context
- Add
POST /api/v1/admin/maintenance accepting { enabled: boolean }, gated by the existing apiKeyAuth middleware.
- The toggle must update the same in-process flag
maintenanceMode() reads, taking effect on the next request with no restart.
- Log the transition through
middleware/auditLog.ts including the actor and timestamp.
🛠️ Suggested execution
- Wire a small in-memory mutable flag module read by
maintenanceMode.ts and written by the new route.
- Add the route under
src/routes/ (or extend src/app.ts if routes are kept flat) with apiKeyAuth applied.
- Add route tests asserting non-maintenance routes start returning
503 immediately after the toggle, and that unauthenticated toggle attempts are rejected.
✅ Acceptance criteria
🔒 Security notes
Restrict the endpoint to the same API key used elsewhere; consider requiring a distinct admin-scoped key if the general API key is broadly distributed.
📋 Guidelines
- Minimum 95% test coverage
- Clear documentation
- Timeframe: 96 hours
📌 Description
src/middleware/maintenanceMode.tsexposes amaintenanceMode(enabled)middleware factory, but nothing insrc/app.ts/src/routescurrently lets an operator flip it without a redeploy. Add an authenticated toggle endpoint.🧩 Requirements and context
POST /api/v1/admin/maintenanceaccepting{ enabled: boolean }, gated by the existingapiKeyAuthmiddleware.maintenanceMode()reads, taking effect on the next request with no restart.middleware/auditLog.tsincluding the actor and timestamp.🛠️ Suggested execution
maintenanceMode.tsand written by the new route.src/routes/(or extendsrc/app.tsif routes are kept flat) withapiKeyAuthapplied.503immediately after the toggle, and that unauthenticated toggle attempts are rejected.✅ Acceptance criteria
🔒 Security notes
Restrict the endpoint to the same API key used elsewhere; consider requiring a distinct admin-scoped key if the general API key is broadly distributed.
📋 Guidelines