From 34d9b747e41a137a76d17fbfa12e580cd1de5728 Mon Sep 17 00:00:00 2001
From: jihadMo <jihadMo@users.noreply.github.com>
Date: Sat, 8 Aug 2026 05:27:09 +0100
Subject: [PATCH] fix(sec): apply authMiddleware to userRoutes router (#11396)

---
 apps/api/src/routes/user-auth.test.js | 9 +++++++++
 apps/api/src/routes/userRoutes.js     | 2 ++
 2 files changed, 11 insertions(+)
 create mode 100644 apps/api/src/routes/user-auth.test.js

diff --git a/apps/api/src/routes/user-auth.test.js b/apps/api/src/routes/user-auth.test.js
new file mode 100644
index 00000000000..32f19e8ed98
--- /dev/null
+++ b/apps/api/src/routes/user-auth.test.js
@@ -0,0 +1,9 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { userRoutes } from "./userRoutes.js";
+
+test("userRoutes has authMiddleware mounted", () => {
+  assert.ok(userRoutes.stack.length > 0, "userRoutes stack must contain middleware");
+  const hasAuthMiddleware = userRoutes.stack.some((layer) => layer.handle?.name === "authMiddleware");
+  assert.equal(hasAuthMiddleware, true, "userRoutes router must include authMiddleware layer");
+});
diff --git a/apps/api/src/routes/userRoutes.js b/apps/api/src/routes/userRoutes.js
index f1ef183b1bc..bebe1006abb 100644
--- a/apps/api/src/routes/userRoutes.js
+++ b/apps/api/src/routes/userRoutes.js
@@ -1,7 +1,9 @@
 import { Router } from "express";
 import { getUsers, postUser } from "../controllers/userController.js";
+import { authMiddleware } from "../middleware/auth.js";
 
 export const userRoutes = Router();
 
+userRoutes.use(authMiddleware);
 userRoutes.get("/", getUsers);
 userRoutes.post("/", postUser);