From 3a20e37625241e142c049c19a249d4e96e824438 Mon Sep 17 00:00:00 2001 From: Anso Date: Fri, 24 Apr 2026 10:21:25 -0400 Subject: [PATCH] docs(backend): strip stale phase annotations from canonical-order comment (#753) The canonical middleware-order comment in app.ts carried historical notes from the index.ts refactor ("before Phase 4 finishes", "moves to routes/* in Phase 4", "moves here in Phase 5") that are no longer active-voice descriptions of current state. Replace with plain descriptions matching the final module layout. The 16-step enumeration and the invariant paragraph about public routers (metaRouter, authRouter, mfaRouter, ssoRouter) sitting before the auth gate are preserved. No behavior change. --- backend/src/app.ts | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/backend/src/app.ts b/backend/src/app.ts index 9a8f99df..47cc90ba 100644 --- a/backend/src/app.ts +++ b/backend/src/app.ts @@ -23,18 +23,18 @@ import './types/express'; * 7. pollingLimiter (at /api) * 8. conditionalJsonParser * 9. nodeContextMiddleware - * 10. authGate (at /api) -- registered in index.ts (before Phase 4 finishes) + * 10. authGate (at /api) -- registered in index.ts * 11. auditLog (at /api) -- registered in index.ts * 12. enforceApiTokenScope (at /api) -- registered in index.ts * 13. createRemoteProxyMiddleware -- proxy/remoteNodeProxy.ts, registered in index.ts - * 14. routes -- registered in index.ts (moves to routes/* in Phase 4) - * 15. static serving + SPA fallback -- registered in index.ts (moves here in Phase 5) + * 14. routes -- registered in index.ts from routes/* + * 15. static serving + SPA fallback -- registered in index.ts * 16. errorHandler -- registered in index.ts * - * Steps 10-12 and 14 must run after the auth routes are registered so those - * routes can remain public (login, setup, MFA, SSO). Once all routes live in - * `routes/*.ts` routers and are mounted here in `createApp()`, every step - * collapses into this factory. + * Steps 10 to 12 and 14 must run after the public auth routers (meta, auth, + * mfa, sso) are registered so those routes stay reachable without a session + * cookie. index.ts mounts those public routers before step 10 to preserve + * that invariant. */ export function createApp(): express.Express { const app = express();