fix ops local admin redirects

frontend/lib/ops-admin.ts

@@ -1,11 +1,14 @@
-import { cookies } from "next/headers";
+import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
+import { isLocalOpsAccessHost } from "@/lib/ops-local-access";
 import {
   createSupabaseServerClient,
   hasSupabaseServerEnv,
   hasSupabaseSessionCookieValues,
 } from "@/lib/supabase/server";
 
+const LOCAL_DEV_OPS_EMAIL = "local-dev@polyweather.local";
+
 function parseAdminEmails() {
   return String(process.env.POLYWEATHER_OPS_ADMIN_EMAILS || "")
     .split(",")
@@ -14,6 +17,13 @@ function parseAdminEmails() {
 }
 
 export async function requireOpsAdmin(nextPath = "/ops") {
+  const headerStore = await headers();
+  const requestHost =
+    headerStore.get("x-forwarded-host") || headerStore.get("host") || "";
+  if (isLocalOpsAccessHost(requestHost)) {
+    return { email: LOCAL_DEV_OPS_EMAIL };
+  }
+
   const allowedEmails = parseAdminEmails();
   if (!allowedEmails.length || !hasSupabaseServerEnv()) {
     redirect("/");

frontend/lib/ops-local-access.ts

@@ -0,0 +1,11 @@
+import { extractHostname, isLocalHostname } from "@/lib/local-dev-access";
+
+function readLocalOpsAccessFlag() {
+  const raw = process.env.POLYWEATHER_LOCAL_OPS_FULL_ACCESS;
+  if (raw == null) return process.env.NODE_ENV !== "production";
+  return !/^(0|false|off|no)$/i.test(String(raw).trim());
+}
+
+export function isLocalOpsAccessHost(value?: string | null) {
+  return readLocalOpsAccessFlag() && isLocalHostname(extractHostname(value));
+}

frontend/lib/ops-proxy-auth.ts

@@ -4,6 +4,7 @@ import {
   applyAuthResponseCookies,
   type BackendHeaderBuildResult,
 } from "@/lib/backend-auth";
+import { isLocalOpsAccessHost } from "@/lib/ops-local-access";
 
 function hasBearerAuth(request: NextRequest) {
   const raw = request.headers.get("authorization");
@@ -12,10 +13,22 @@ function hasBearerAuth(request: NextRequest) {
   return parts.length === 2 && parts[0].toLowerCase() === "bearer" && Boolean(parts[1]);
 }
 
+function isLocalOpsAccessRequest(request: NextRequest) {
+  const requestHost =
+    request.headers.get("x-forwarded-host") ||
+    request.headers.get("host") ||
+    request.nextUrl.host;
+  return (
+    isLocalOpsAccessHost(requestHost) ||
+    isLocalOpsAccessHost(request.nextUrl.hostname)
+  );
+}
+
 export function requireOpsProxyAuth(
   request: NextRequest,
   auth: BackendHeaderBuildResult,
 ): NextResponse | null {
+  if (isLocalOpsAccessRequest(request)) return null;
   if (auth.authUserId || hasBearerAuth(request)) return null;
   return applyAuthResponseCookies(
     NextResponse.json(