Files
main.tsmain
What you'll learn
- Guard routes with bearerAuth({ token }) and tell its three refusals apart: no header, a malformed header, a wrong token
- Accept several tokens with an array, and give reads and writes different guards with app.on()
- Know where a fixed token stops and a verified one begins: verifyToken, and the next lesson's JWT
Press Run tests to start the app. Its log appears here.Graded endpoints
No Authorization header: 401 with a Bearer challenge whose realm is empty by default
An Authorization header that is not Bearer <token> is a 400, and the challenge says invalid_request
Well-formed but not one of ours: 401 with invalid_token
The read guard accepts either token
The write guard accepts only the writer token: a reader is refused as an invalid token
The writer creates a cat
The writer token is in the read guard's list too
DELETE is a write: the same guard as POST
Refused before the handler: the cat stays
Past the guard, the handler's own 404
Tom was removed by the writer; Luna's deletion was refused, so she stays
The guards are scoped to /api/*: health needs no token