fix ops local admin redirects

2026-06-14 22:44:02 +08:00
parent 8bbe8f74c1
commit a9e9eed2f1
6 changed files with 119 additions and 2 deletions
@@ -216,9 +216,13 @@ export function runTests() {
  const optionalRefreshIndex = middlewareSource.indexOf(
    "function shouldRefreshOptionalSupabaseSession",
  );
+  const publicApiFunction = middlewareSource.slice(
+    middlewareSource.indexOf("function isPublicApi"),
+    middlewareSource.indexOf("function shouldRefreshOptionalSupabaseSession"),
+  );
  assert(
    optionalRefreshIndex >= 0 &&
-      !middlewareSource.includes('pathname === "/api/system/status"'),
+      !publicApiFunction.includes('pathname === "/api/system/status"'),
    "middleware must not treat system status as public after it becomes an ops-only API",
  );

@@ -0,0 +1,62 @@
+import fs from "node:fs";
+import path from "node:path";
+
+function assert(condition: unknown, message: string) {
+  if (!condition) throw new Error(message);
+}
+
+export function runTests() {
+  const projectRoot = process.cwd();
+  const opsAdminSource = fs.readFileSync(
+    path.join(projectRoot, "lib", "ops-admin.ts"),
+    "utf8",
+  );
+  const middlewareSource = fs.readFileSync(
+    path.join(projectRoot, "middleware.ts"),
+    "utf8",
+  );
+  const opsProxyAuthSource = fs.readFileSync(
+    path.join(projectRoot, "lib", "ops-proxy-auth.ts"),
+    "utf8",
+  );
+  const opsLocalAccessSource = fs.readFileSync(
+    path.join(projectRoot, "lib", "ops-local-access.ts"),
+    "utf8",
+  );
+
+  assert(
+    middlewareSource.includes("isLocalOpsAccessHost") &&
+      middlewareSource.includes('pathname.startsWith("/ops")') &&
+      middlewareSource.includes('pathname.startsWith("/api/ops")') &&
+      middlewareSource.includes('pathname === "/api/system/status"') &&
+      middlewareSource.indexOf("isLocalOpsAccessHost") <
+        middlewareSource.indexOf("handleTerminalGate"),
+    "middleware must honor localhost ops access before redirecting /ops to login",
+  );
+
+  assert(
+    opsAdminSource.includes("headers") &&
+      opsAdminSource.includes("isLocalOpsAccessHost") &&
+      opsAdminSource.includes("local-dev@polyweather.local") &&
+      opsAdminSource.indexOf("isLocalOpsAccessHost") <
+        opsAdminSource.indexOf("parseAdminEmails"),
+    "ops server page gate must honor localhost ops access before Supabase/admin-email redirects",
+  );
+
+  assert(
+    opsProxyAuthSource.includes("isLocalOpsAccessHost") &&
+      opsProxyAuthSource.includes("x-forwarded-host") &&
+      opsProxyAuthSource.includes("request.nextUrl.hostname") &&
+      opsProxyAuthSource.indexOf("isLocalOpsAccessHost") <
+        opsProxyAuthSource.indexOf("auth.authUserId"),
+    "ops API proxy auth must allow localhost ops access before requiring a Supabase session",
+  );
+
+  assert(
+    opsLocalAccessSource.includes("POLYWEATHER_LOCAL_OPS_FULL_ACCESS") &&
+      opsLocalAccessSource.includes('process.env.NODE_ENV !== "production"') &&
+      opsLocalAccessSource.includes("isLocalHostname") &&
+      !opsLocalAccessSource.includes("NEXT_PUBLIC_POLYWEATHER_LOCAL_FULL_ACCESS"),
+    "ops local access must be a server-side dev-only switch independent from the public product full-access flag",
+  );
+}