fix: Routes protection

Author: JonaszJestem

src/authentication/protected-routes.handler.ts

@@ -43,10 +43,11 @@ export const isAdminRoute = (url: string, adminRootUrl: string): boolean => {
     .map((route) => convertToExpressRoute(route.path))
     .filter((route) => route !== "");
   const isAdminRootUrl = url === adminRootUrl;
+  const urlWithoutRoot = url.substring(adminRootUrl?.length ?? 0, url.length);
 
   return (
     isAdminRootUrl ||
-    !!adminRoutes.find((route) => pathToRegexp(route).test(url))
+    adminRoutes.some((route) => pathToRegexp(route).test(urlWithoutRoot))
   );
 };
 

src/buildAuthenticatedRouter.ts

@@ -55,6 +55,7 @@ export const buildAuthenticatedRouter = (
   const router = predefinedRouter || express.Router();
 
   router.use((req, _, next) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     if ((req as any)._body) {
       next(new OldBodyParserUsedError());
     }

test/protected-routes.test.ts

@@ -32,5 +32,11 @@ describe("Protected routes", () => {
     it("should detect non-admin routes", () => {
       expect(isAdminRoute("/api/my-endpoint", "/")).toBeFalsy();
     });
+
+    it("should detect admin routes with base url", () => {
+      expect(
+        isAdminRoute("/admin/resources/someResource/actions/new", "/admin")
+      ).toBeTruthy();
+    });
   });
 });