Stefan Lazic
17eee5b932
CI / ci (push) Canceled after 0s
The session built: Appointments page: a single list, newest first. Block Time: edit and delete. Customer CSV export: with barber notes excluded. Guest-link regression test: a test that an appointment id alone is rejected, plus fixes to the stale docs. It built the scheduler, job runner with live progress, backup and restore, and the health alerts. Its own report says a real delete-and-restore on throwaway Docker passed, but I haven’t repeated that. It also says real SMTP and large dumps were not exercised. The manager image needs rebuilding for the backups to work, because it now installs 7zip.
35 lines
1.4 KiB
TypeScript
35 lines
1.4 KiB
TypeScript
import { NextResponse, type NextRequest } from "next/server";
|
|
import { SESSION_COOKIE_NAME, verifySessionToken } from "@/lib/session";
|
|
|
|
// Next.js 16 renamed the `middleware.ts` file convention to `proxy.ts`
|
|
// (https://nextjs.org/docs/messages/middleware-to-proxy) — it now always
|
|
// runs on the Node.js runtime, which is why plain `node:crypto` in
|
|
// session.ts works fine here without any Edge-runtime workaround.
|
|
|
|
const PUBLIC_PATHS = ["/login"];
|
|
|
|
export default function proxy(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
if (PUBLIC_PATHS.some((path) => pathname.startsWith(path))) return NextResponse.next();
|
|
|
|
const token = request.cookies.get(SESSION_COOKIE_NAME)?.value;
|
|
const session = verifySessionToken(token);
|
|
if (!session) {
|
|
const loginUrl = new URL("/login", request.url);
|
|
return NextResponse.redirect(loginUrl);
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|
|
|
|
export const config = {
|
|
// Runs on every page and API route except static assets — this app has
|
|
// no public-facing content at all, unlike the main app's proxy.ts,
|
|
// which has to carve out installation/customer-facing exceptions.
|
|
//
|
|
// api/backups/upload is excluded deliberately: a proxy buffers (and
|
|
// truncates at 10 MB) every request body it sees, which would corrupt a
|
|
// large backup upload. That route verifies the session cookie itself.
|
|
matcher: ["/((?!_next/static|_next/image|favicon.ico|api/backups/upload).*)"],
|
|
};
|