From cd272e2b6c061effa52c6752e3fa06f4e70d0e14 Mon Sep 17 00:00:00 2001
From: itsrubberduck <frappes_remoter.2e@icloud.com>
Date: Sun, 15 Feb 2026 00:24:01 +0100
Subject: [PATCH] fix(atc): whitelist /api/atc/ routes in auth middleware

The global auth middleware was blocking /api/atc/route and /api/atc/ptt
(only /api/atc/say was whitelisted from the old system). Now all /api/atc/
routes are excluded from auth, matching the Live ATC v2 architecture.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 server/middleware/auth.global.ts | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/server/middleware/auth.global.ts b/server/middleware/auth.global.ts
index 1ccc194..5656cdc 100644
--- a/server/middleware/auth.global.ts
+++ b/server/middleware/auth.global.ts
@@ -6,7 +6,7 @@ export default defineEventHandler(async (event) => {
     if (!url.pathname.startsWith('/api/')) {
         return
     }
-    if (url.pathname.startsWith('/api/atc/say')) {
+    if (url.pathname.startsWith('/api/atc/')) {
         return
     }
     if (url.pathname.startsWith('/api/service/')) {
@@ -15,9 +15,7 @@ export default defineEventHandler(async (event) => {
     if (url.pathname.startsWith('/api/bridge/')) {
         return
     }
-    if (url.pathname === '/api/decision-flows/runtime') {
-        return
-    }
+    // /api/decision-flows/ was removed in Live ATC v2
     if (event.node.req.method === 'OPTIONS') {
         return
     }