From e6c99c946a3b69c79ed33319daa566bec8291751 Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Sun, 14 Jun 2026 04:40:02 +0800
Subject: [PATCH] Fix optional feedback auth fallback

---
 deploy.ps1                                    |  2 +-
 frontend/app/api/feedback/route.ts            | 21 ++++++++++++++++---
 .../__tests__/feedbackWorkflow.test.ts        |  6 ++++++
 scripts/validate_frontend_cache.sh            |  2 +-
 tests/test_deployment_runtime_config.py       | 12 +++++++++++
 5 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/deploy.ps1 b/deploy.ps1
index 04d6e2d3..de529e98 100644
--- a/deploy.ps1
+++ b/deploy.ps1
@@ -1,4 +1,4 @@
-$VPS = "root@38.54.27.70"
+$VPS = "root@172.245.214.111"
 $PROJECT = "/root/PolyWeather"
 
 Write-Host "🚀 Deploying to $VPS..." -ForegroundColor Cyan
diff --git a/frontend/app/api/feedback/route.ts b/frontend/app/api/feedback/route.ts
index bcdbd330..d3ff02f4 100644
--- a/frontend/app/api/feedback/route.ts
+++ b/frontend/app/api/feedback/route.ts
@@ -2,7 +2,6 @@ import { NextRequest, NextResponse } from "next/server";
 import {
   applyAuthResponseCookies,
   buildBackendRequestHeaders,
-  requireBackendPaymentAuth,
 } from "@/lib/backend-auth";
 import {
   buildProxyExceptionResponse,
@@ -11,6 +10,21 @@ import {
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
 
+function emptyFeedbackResponse() {
+  return NextResponse.json(
+    {
+      feedback: [],
+      total: 0,
+      status_counts: {},
+    },
+    {
+      headers: {
+        "Cache-Control": "no-store",
+      },
+    },
+  );
+}
+
 export async function GET(req: NextRequest) {
   if (!API_BASE) {
     return NextResponse.json(
@@ -22,8 +36,9 @@ export async function GET(req: NextRequest) {
   let auth: Awaited<ReturnType<typeof buildBackendRequestHeaders>> | null = null;
   try {
     auth = await buildBackendRequestHeaders(req);
-    const authError = requireBackendPaymentAuth(auth);
-    if (authError) return authError;
+    if (!auth.authUserId) {
+      return applyAuthResponseCookies(emptyFeedbackResponse(), auth.response);
+    }
 
     const upstream = new URL(`${API_BASE}/api/feedback`);
     const limit = req.nextUrl.searchParams.get("limit");
diff --git a/frontend/components/dashboard/scan-terminal/__tests__/feedbackWorkflow.test.ts b/frontend/components/dashboard/scan-terminal/__tests__/feedbackWorkflow.test.ts
index ff11d06c..d2041840 100644
--- a/frontend/components/dashboard/scan-terminal/__tests__/feedbackWorkflow.test.ts
+++ b/frontend/components/dashboard/scan-terminal/__tests__/feedbackWorkflow.test.ts
@@ -69,6 +69,12 @@ export function runTests() {
       feedbackRouteSource.includes("limit"),
     "feedback API proxy must expose a GET endpoint for the current user's feedback status list",
   );
+  assert(
+    feedbackRouteSource.includes("emptyFeedbackResponse") &&
+      feedbackRouteSource.includes("if (!auth.authUserId)") &&
+      !feedbackRouteSource.includes("const authError = requireBackendPaymentAuth(auth);"),
+    "feedback GET proxy must return an empty optional list instead of surfacing a 401 when no Supabase user identity is verified",
+  );
   assert(
     dashboardSource.includes("<UserFeedbackStatusButton") &&
       dashboardSource.includes("feedbackRefreshKey") &&
diff --git a/scripts/validate_frontend_cache.sh b/scripts/validate_frontend_cache.sh
index f22eb013..0684a008 100644
--- a/scripts/validate_frontend_cache.sh
+++ b/scripts/validate_frontend_cache.sh
@@ -2,7 +2,7 @@
 
 set -u
 
-BASE_URL="${1:-http://38.54.27.70:8000}"
+BASE_URL="${1:-https://polyweather.top}"
 CURL_BIN="${CURL_BIN:-curl}"
 
 PASS_COUNT=0
diff --git a/tests/test_deployment_runtime_config.py b/tests/test_deployment_runtime_config.py
index 530b2461..2a04a702 100644
--- a/tests/test_deployment_runtime_config.py
+++ b/tests/test_deployment_runtime_config.py
@@ -257,6 +257,18 @@ def test_deploy_token_is_passed_over_stdin_not_process_args():
     assert "bash /tmp/deploy.sh '${{ secrets.GHCR_PAT }}'" not in workflow
 
 
+def test_deployment_helpers_do_not_reference_retired_vps_ip():
+    retired_ip = "38.54.27.70"
+    deploy_ps1 = (ROOT / "deploy.ps1").read_text(encoding="utf-8")
+    cache_script = (ROOT / "scripts" / "validate_frontend_cache.sh").read_text(
+        encoding="utf-8"
+    )
+
+    assert retired_ip not in deploy_ps1
+    assert retired_ip not in cache_script
+    assert 'BASE_URL="${1:-https://polyweather.top}"' in cache_script
+
+
 def test_docker_compose_keeps_polyweather_ports_on_loopback():
     compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")