diff --git a/backend/src/main/java/com/recipeapp/auth/SecurityConfig.java b/backend/src/main/java/com/recipeapp/auth/SecurityConfig.java index eb98a48..7de26fe 100644 --- a/backend/src/main/java/com/recipeapp/auth/SecurityConfig.java +++ b/backend/src/main/java/com/recipeapp/auth/SecurityConfig.java @@ -24,7 +24,7 @@ public class SecurityConfig { .authorizeHttpRequests(auth -> auth .requestMatchers("/v1/auth/signup", "/v1/auth/login").permitAll() .requestMatchers("/swagger-ui/**", "/v3/api-docs/**").permitAll() - .requestMatchers("/v1/invites/*").permitAll() + .requestMatchers("/v1/invites/**").permitAll() .requestMatchers("/v1/admin/**").hasAuthority("ROLE_ADMIN") .anyRequest().authenticated()) .exceptionHandling(ex -> ex diff --git a/backend/src/test/java/com/recipeapp/auth/SecurityConfigTest.java b/backend/src/test/java/com/recipeapp/auth/SecurityConfigTest.java index 96b7c17..7bfe67b 100644 --- a/backend/src/test/java/com/recipeapp/auth/SecurityConfigTest.java +++ b/backend/src/test/java/com/recipeapp/auth/SecurityConfigTest.java @@ -10,6 +10,7 @@ import org.springframework.web.context.WebApplicationContext; import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; class SecurityConfigTest extends AbstractIntegrationTest { @@ -33,6 +34,15 @@ class SecurityConfigTest extends AbstractIntegrationTest { .andExpect(status().isNotFound()); } + @Test + void inviteAcceptEndpointIsAccessibleWithoutAuthentication() throws Exception { + // 400 = validation error (empty body), but NOT 401 — proves the path is permitted + mockMvc.perform(post("/v1/invites/ANYCODE/accept") + .contentType(org.springframework.http.MediaType.APPLICATION_JSON) + .content("{}")) + .andExpect(status().isBadRequest()); + } + @Test void protectedEndpointRequiresAuthentication() throws Exception { mockMvc.perform(get("/v1/households/mine")) diff --git a/frontend/src/routes/(public)/join/[token]/+page.svelte b/frontend/src/routes/(public)/join/[token]/+page.svelte index 9b52121..c271495 100644 --- a/frontend/src/routes/(public)/join/[token]/+page.svelte +++ b/frontend/src/routes/(public)/join/[token]/+page.svelte @@ -26,7 +26,7 @@
-
+
-
+

{householdName}

-

+

Eingeladen von {inviterName}

-
-

+

+

Als Mitglied kannst du

    -
  • - +
  • + Wochenplan einsehen
    • -
  • - +
  • + Einkaufsliste abhaken
    • -
  • - +
  • + Artikel zur Liste hinzufügen