Stefan Lazic
6ae145d187
Seed data extended with a second barber (different hours/services), a beard-trim service + category, breaks, time off, a guest customer, and appointments in all three key states — verified against a live throwaway Postgres. 14 new integration tests (38 total with Phase 3's) covering guest/authenticated booking, any-barber assignment, slot-conflict handling, ownership enforcement, guest-data isolation, and book-again repricing. Playwright E2E suite for the 6 required customer journeys, with its own global-setup.ts that migrates and seeds a database automatically. Full verification pass, which caught and fixed three real bugs along the way (not just test-workarounds): A date off-by-one bug in the calendar picker that made real weekdays show as closed for anyone in a UTC+ timezone (including the business's own). A dialog that could vanish mid-confirmation on cancellation, before the customer could read the late-cancellation notice. A silent test-cleanup leak in the Phase 3 fixtures that had been leaking stray businesses since Phase 3. Plus a baseline desktop-responsive fix (centered max-w-2xl columns) across Home/Appointments/Settings/booking flow, since desktop had been effectively unstyled. Final state: 90 unit tests, 38 integration tests, and all 6 E2E journeys passing together on a fresh database; clean tsc, eslint, and next build. Full writeup with routes, security model, guest-matching rules, known limitations, and what to check before Phase 5 is in docs/phase-4-summary.md.
37 lines
1.5 KiB
TypeScript
37 lines
1.5 KiB
TypeScript
import NextAuth from "next-auth";
|
|
import { NextResponse } from "next/server";
|
|
import { authConfig } from "@/auth.config";
|
|
|
|
// /home, /appointments and /settings are intentionally NOT hard-gated here
|
|
// as of Phase 4 — Home must work for guests (public business browsing +
|
|
// booking), and /appointments and /settings each show their own friendly
|
|
// in-context sign-in prompt for a guest rather than a silent redirect with
|
|
// no explanation. Only /staff and /owner remain hard-gated: those are
|
|
// permission-based tooling with no meaningful "guest" experience at all.
|
|
const PROTECTED_PREFIXES = ["/staff", "/owner"];
|
|
|
|
// Lightweight instance built from the DB-free config — see auth.config.ts.
|
|
// Next.js 16 renamed this file convention from `middleware` to `proxy`
|
|
// (https://nextjs.org/docs/messages/middleware-to-proxy); it now always
|
|
// runs on the Node.js runtime rather than Edge, but this stays split from
|
|
// the full `@/auth` regardless, so checking "is there a session" doesn't
|
|
// spin up a Postgres connection pool on every request.
|
|
const { auth } = NextAuth(authConfig);
|
|
|
|
export default auth((req) => {
|
|
const { pathname } = req.nextUrl;
|
|
const isProtected = PROTECTED_PREFIXES.some(
|
|
(prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
|
|
);
|
|
|
|
if (isProtected && !req.auth) {
|
|
const signInUrl = new URL("/sign-in", req.nextUrl.origin);
|
|
signInUrl.searchParams.set("callbackUrl", pathname);
|
|
return NextResponse.redirect(signInUrl);
|
|
}
|
|
});
|
|
|
|
export const config = {
|
|
matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],
|
|
};
|