fix: remove auth header from non-auth routes

Author: moe-mizrak

src/Resolvers/HeadersResolver.php

@@ -57,11 +57,10 @@ public function resolve(
         // Prepare the final headers by merging the resolved headers with the original request headers.
         return $this->prepareMappedHeaders(
             $requestData,
-            overrides: [
-                // Prioritize resolved headers over request headers.
-                HttpHeaderType::AUTHORIZATION->value => Arr::get($resolvedHeaders, 'authorization')
-                    ?? $requestData?->headers?->authorization,
-            ]
+            overrides: array_filter([
+                // Prioritize resolved headers over request headers
+                HttpHeaderType::AUTHORIZATION->value => Arr::get($resolvedHeaders, 'authorization'),
+            ], fn($value) => ! is_null($value))
         );
     }
 }

src/Traits/RequestParsingTrait.php

@@ -111,9 +111,12 @@ protected function prepareMappedHeaders(?RequestData $requestData, array $overri
     {
         $headersData = $requestData?->headers;
 
+        // Only add authorization header if the route requires authentication
+        $authenticationHeader = $this->routeRequiresAuth($requestData?->routeName) ? $headersData?->authorization : null;
+
         // Map the headers to the correct format as hyphenated capitalization
         $mappedHeaders = [
-            HttpHeaderType::AUTHORIZATION->value => $headersData?->authorization,
+            HttpHeaderType::AUTHORIZATION->value => $authenticationHeader,
             HttpHeaderType::ACCEPT->value => $headersData?->accept,
             HttpHeaderType::ACCEPT_LANGUAGE->value => $headersData?->acceptLanguage,
         ];
@@ -164,4 +167,30 @@ protected function prepareCookies(?RequestData $requestData, array $overrides =
             fn ($value) => ! is_null($value)
         );
     }
+
+    /**
+     * Check if a given route requires authentication by inspecting its middleware.
+     *
+     * @param string|null $routeName
+     *
+     * @return bool
+     */
+    private function routeRequiresAuth(?string $routeName): bool
+    {
+        if ($routeName) {
+            $middlewareArray = app('router')
+                ->getRoutes()
+                ->getByName($routeName)?->gatherMiddleware() ?? [];
+
+            // Check if any middleware has 'auth' prefix
+            foreach ($middlewareArray as $middleware) {
+                // catches: 'auth', 'auth:api', 'auth:sanctum', 'auth:web'
+                if (str_starts_with($middleware, 'auth')) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
 }

tests/Resolvers/HeadersResolverTest.php

@@ -58,10 +58,11 @@ public function it_tests_if_authentication_headers_are_forwarded(): void
         /* SETUP */
         $bearerToken = 'your-token-here';
         $request = Request::create(
-            uri: "/sample_trigger_route",
+            uri: "/auth-protected-route",
             method: Request::METHOD_GET,
         );
         $request->headers->set(HttpHeaderType::AUTHORIZATION->value, 'Bearer ' . $bearerToken);
+        $request->setRouteResolver(fn () => $this->app['router']->getRoutes()->match($request));
         $this->requestData = RequestData::fromRequest($request);
 
         /* EXECUTE */

tests/TestCase.php

@@ -100,5 +100,20 @@ protected function defineRoutes($router): void
             ->get('/sample-target-route-with-middleware', function () {
                 return new Response('ok', Response::HTTP_OK);
             })->name('sample.target.route.with.middleware');
+
+        // Define route with auth middleware
+        $router->middleware('auth')->get('/auth-protected-route', function () {
+            return new Response('ok', Response::HTTP_OK);
+        })->name('auth.protected.route');
+
+        // Define public route with no auth middleware
+        $router->get('/public-route-no-auth', function () {
+            return new Response('ok', Response::HTTP_OK);
+        })->name('public.route.no.auth');
+
+        // Define route with auth middleware that requires token from login request
+        $router->middleware('auth')->get('/sample-target-route-requires-token-from-login-request', function () {
+            return new Response('ok', Response::HTTP_OK);
+        })->name('sample.target.route.requires.token.from.login.request');
     }
 }

tests/Traits/RequestParsingTraitTest.php

@@ -351,7 +351,6 @@ public function it_prepares_mapped_headers_with_defaults_and_default_prefetch_he
         /* ASSERT */
         $this->assertSame(
             [
-                HttpHeaderType::AUTHORIZATION->value => 'Bearer token',
                 HttpHeaderType::ACCEPT->value => 'application/json',
                 HttpHeaderType::ACCEPT_LANGUAGE->value => 'en-US',
                 config('demon-dextral-horn.defaults.prefetch_header') => PrefetchType::AUTO->value,
@@ -388,6 +387,92 @@ public function it_applies_header_overrides(): void
         $this->assertSame($acceptValue, Arr::get($headers, HttpHeaderType::ACCEPT->value));
     }
 
+    #[Test]
+    public function it_applies_authorization_header_override(): void
+    {
+        /* SETUP */
+        $headersData = new HeadersData(
+            authorization: null,
+            accept: 'application/json',
+            acceptLanguage: 'en-US'
+        );
+        $requestData = new RequestData(
+            uri: '/sample_route',
+            method: Request::METHOD_GET,
+            headers: $headersData,
+            routeName: 'sample.route',
+        );
+        $authValue = 'Bearer overridden_token';
+        $overrides = [
+            HttpHeaderType::AUTHORIZATION->value => $authValue,
+        ];
+
+        /* EXECUTE */
+        $headers = $this->anonymousClass->callPrepareMappedHeaders($requestData, $overrides);
+
+        /* ASSERT */
+        $this->assertArrayHasKey(HttpHeaderType::AUTHORIZATION->value, $headers);
+        $this->assertSame($authValue, Arr::get($headers, HttpHeaderType::AUTHORIZATION->value));
+    }
+
+    #[Test]
+    public function it_forwards_authorization_header_for_route_with_auth_middleware(): void
+    {
+        /* SETUP */
+        $token = 'Bearer sample_token';
+        $acceptValue = 'application/json';
+        $languageValue = 'en-US';
+        $headersData = new HeadersData(
+            authorization: $token,
+            accept: $acceptValue,
+            acceptLanguage: $languageValue
+        );
+        $requestData = new RequestData(
+            uri: '/auth-protected-route',
+            method: Request::METHOD_GET,
+            headers: $headersData,
+            routeName: 'auth.protected.route',
+        );
+
+        /* EXECUTE */
+        $headers = $this->anonymousClass->callPrepareMappedHeaders($requestData);
+    
+        /* ASSERT */
+        $this->assertArrayHasKey(HttpHeaderType::AUTHORIZATION->value, $headers);
+        $this->assertSame($token, $headers[HttpHeaderType::AUTHORIZATION->value]);
+        $this->assertSame($acceptValue, $headers[HttpHeaderType::ACCEPT->value]);
+        $this->assertSame($languageValue, $headers[HttpHeaderType::ACCEPT_LANGUAGE->value]);
+        $this->assertArrayHasKey(config('demon-dextral-horn.defaults.prefetch_header'), $headers);
+    }
+
+    #[Test]
+    public function it_does_not_forward_authorization_header_for_public_named_route(): void
+    {
+        /* SETUP */
+        $acceptValue = 'application/json';
+        $languageValue = 'en-US';
+        $headersData = new HeadersData(
+            authorization: 'Bearer token',
+            accept: $acceptValue,
+            acceptLanguage: $languageValue
+        );
+        $requestData = new RequestData(
+            uri: '/public-route-no-auth',
+            method: Request::METHOD_GET,
+            headers: $headersData,
+            routeName: 'public.route.no.auth',
+        );
+
+        /* EXECUTE */
+        $headers = $this->anonymousClass->callPrepareMappedHeaders($requestData);
+
+        /* ASSERT */
+        $this->assertArrayNotHasKey(HttpHeaderType::AUTHORIZATION->value, $headers);
+        $this->assertSame($acceptValue, $headers[HttpHeaderType::ACCEPT->value]);
+        $this->assertSame($languageValue, $headers[HttpHeaderType::ACCEPT_LANGUAGE->value]);
+        $this->assertArrayHasKey(config('demon-dextral-horn.defaults.prefetch_header'), $headers);
+    }
+
     #[Test]
     public function it_filters_out_null_header_values(): void
     {