Fix optional feedback auth fallback

deploy.ps1

@@ -1,4 +1,4 @@
-$VPS = "root@38.54.27.70"
+$VPS = "root@172.245.214.111"
 $PROJECT = "/root/PolyWeather"
 
 Write-Host "🚀 Deploying to $VPS..." -ForegroundColor Cyan

frontend/app/api/feedback/route.ts

@@ -2,7 +2,6 @@ import { NextRequest, NextResponse } from "next/server";
 import {
   applyAuthResponseCookies,
   buildBackendRequestHeaders,
-  requireBackendPaymentAuth,
 } from "@/lib/backend-auth";
 import {
   buildProxyExceptionResponse,
@@ -11,6 +10,21 @@ import {
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
 
+function emptyFeedbackResponse() {
+  return NextResponse.json(
+    {
+      feedback: [],
+      total: 0,
+      status_counts: {},
+    },
+    {
+      headers: {
+        "Cache-Control": "no-store",
+      },
+    },
+  );
+}
+
 export async function GET(req: NextRequest) {
   if (!API_BASE) {
     return NextResponse.json(
@@ -22,8 +36,9 @@ export async function GET(req: NextRequest) {
   let auth: Awaited<ReturnType<typeof buildBackendRequestHeaders>> | null = null;
   try {
     auth = await buildBackendRequestHeaders(req);
-    const authError = requireBackendPaymentAuth(auth);
-    if (authError) return authError;
+    if (!auth.authUserId) {
+      return applyAuthResponseCookies(emptyFeedbackResponse(), auth.response);
+    }
 
     const upstream = new URL(`${API_BASE}/api/feedback`);
     const limit = req.nextUrl.searchParams.get("limit");

frontend/components/dashboard/scan-terminal/__tests__/feedbackWorkflow.test.ts

@@ -69,6 +69,12 @@ export function runTests() {
       feedbackRouteSource.includes("limit"),
     "feedback API proxy must expose a GET endpoint for the current user's feedback status list",
   );
+  assert(
+    feedbackRouteSource.includes("emptyFeedbackResponse") &&
+      feedbackRouteSource.includes("if (!auth.authUserId)") &&
+      !feedbackRouteSource.includes("const authError = requireBackendPaymentAuth(auth);"),
+    "feedback GET proxy must return an empty optional list instead of surfacing a 401 when no Supabase user identity is verified",
+  );
   assert(
     dashboardSource.includes("<UserFeedbackStatusButton") &&
       dashboardSource.includes("feedbackRefreshKey") &&

scripts/validate_frontend_cache.sh

@@ -2,7 +2,7 @@
 
 set -u
 
-BASE_URL="${1:-http://38.54.27.70:8000}"
+BASE_URL="${1:-https://polyweather.top}"
 CURL_BIN="${CURL_BIN:-curl}"
 
 PASS_COUNT=0

tests/test_deployment_runtime_config.py

@@ -257,6 +257,18 @@ def test_deploy_token_is_passed_over_stdin_not_process_args():
     assert "bash /tmp/deploy.sh '${{ secrets.GHCR_PAT }}'" not in workflow
 
 
+def test_deployment_helpers_do_not_reference_retired_vps_ip():
+    retired_ip = "38.54.27.70"
+    deploy_ps1 = (ROOT / "deploy.ps1").read_text(encoding="utf-8")
+    cache_script = (ROOT / "scripts" / "validate_frontend_cache.sh").read_text(
+        encoding="utf-8"
+    )
+
+    assert retired_ip not in deploy_ps1
+    assert retired_ip not in cache_script
+    assert 'BASE_URL="${1:-https://polyweather.top}"' in cache_script
+
+
 def test_docker_compose_keeps_polyweather_ports_on_loopback():
     compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")