fix(sec): require authMiddleware for proposal creation without restricting reads (#11618)

apps/api/src/routes/proposal-auth.test.js

@@ -0,0 +1,16 @@
+import request from "supertest";
+import { app } from "../app.js";
+
+describe("Proposal Creation Auth Requirement (#11618)", () => {
+  it("GET /api/proposals should allow public reads without auth", async () => {
+    const res = await request(app).get("/api/proposals");
+    expect(res.status).not.toBe(401);
+  });
+
+  it("POST /api/proposals should return 401 unauthenticated", async () => {
+    const res = await request(app)
+      .post("/api/proposals")
+      .send({ title: "Test Proposal", description: "Desc", budget: 100 });
+    expect(res.status).toBe(401);
+  });
+});

apps/api/src/routes/proposalRoutes.js

@@ -1,7 +1,8 @@
 import { Router } from "express";
 import { getProposals, postProposal } from "../controllers/proposalController.js";
+import { authMiddleware } from "../middleware/auth.js";
 
 export const proposalRoutes = Router();
 
 proposalRoutes.get("/", getProposals);
-proposalRoutes.post("/", postProposal);
+proposalRoutes.post("/", authMiddleware, postProposal);