hydra-gate-route-auth

To check Nextcloud controllers for missing authentication attributes, scan appinfo/routes.php and cross-reference route definitions with controller method signatures to identify endpoints lacking required security middleware like PublicPage or NoAdminRequired.

Enforce ADR-005 security compliance in your Nextcloud CI/CD pipeline by running an automated route audit that validates every controller method explicitly declares its access posture via PHP attributes or docblock tags before merging code into production.

If a Nextcloud controller method lacks a NoAdminRequired or PublicPage attribute, the endpoint may be accidentally exposed to unauthorized users due to default admin-only restrictions or missing middleware, creating a security vulnerability.

Yes, you can detect unauthenticated Nextcloud API endpoints before deploying to production by running an automated route auditing process during your CI/CD workflow that flags endpoints missing required access control declarations.

Yes, the route auditing process supports both PHP attributes and docblock tags to verify that every controller method registered in a Nextcloud application explicitly declares its authentication posture and security middleware.

Nextcloud endpoints may be accidentally exposed to unauthorized users when controller methods lack explicit authentication posture declarations, bypassing default admin-only restrictions due to missing security middleware attributes or docblock tags.