Claude (SIAX platform session)
1c1e2cb649
The auth seam read `process.env.AUTH_ENFORCE === 'true'`, so an absent env var meant NO authentication: any fresh container, local run, DR restore or redeploy that dropped the variable served /api/0pt/* anonymously, taking the tenant from the caller-supplied X-Tenant-Id header. 0pt.app is deployed and was answering anonymously (verified: an invalid Bearer token plus an arbitrary X-Tenant-Id returned 200), so this was a live hole, not latent. * authEnforced() now returns true unless AUTH_ENFORCE is explicitly "false" (trimmed, case-insensitive). Unset/empty/misspelled => ENFORCED. * assertAuthConfigSafe() throws AuthMisconfigurationError when NODE_ENV=production and enforcement resolved off, naming AUTH_ENFORCE. It runs at middleware module load (startup) and on the env-driven request path, so a production instance can neither boot nor serve a single unauthenticated request with auth switched off. * .env.example no longer teaches AUTH_ENFORCE=false; README's Deploy section states the fail-closed posture (no DEPLOY.md in this repo). * 7 new tests, incl. the regression case: with AUTH_ENFORCE unset and no `enforce` option, an unauthenticated request is rejected with 401. No test was inverted or deleted -- none asserted the open default; the three enforce:false cases now describe the explicit local-dev escape hatch. Tests: 121 passed / 1 skipped before, 128 passed / 1 skipped after. Typecheck and build clean; advisory lint unchanged (16 pre-existing problems). Scope: auth default only. The matcher still covers /api/0pt/* alone, and the handlers still take tenant_id from the query/body rather than the verified principal -- both described in the PR body, neither fixed here.
0pt — your data
Data services on demand for the Nordics + Europe. Compose a data job, pay 50 % to start, watch production live, validate with full provenance, deliver anywhere. Owned by SIAX Technology AB. Honest accuracy is the moat: every field carries source, freshness and confidence; nothing is guessed.
Live: https://0pt.app · Contract: CLAUDE.md + docs/
Two planes (see docs/02-architecture.md)
- Edge (Vercel, this app) — marketing, catalog, the order lifecycle, customer portal,
admin portal, and the API route handlers. Defers to the data engine when
ENGINE_URLis set. - Engine (
services/api, runs on a VPS) — FastAPI orchestrator + worker pipeline doing the compliant sourcing (official API → bulk → authorized web → licensed → else level 0). Never on Vercel (long jobs). Bypass/stealth/proxy-rotation/fake-account paths are excluded by design (CLAUDE.md §1).
Routes
| Area | Routes |
|---|---|
| Marketing | / (hero, filosofi, katalog, motorn, visualiseringar, täckning, editorial, bevis, priser, footer) |
| Catalog | /katalog, /katalog/[id] |
| Sourcing map | /kallor |
| Order lifecycle | /bestall → /bestall/forskott → /order/[id] → /order/[id]/validera |
| Customer portal | /portal, /portal/subscriptions, /portal/files, /portal/integrationer, /portal/settings |
| Admin portal | /admin, /admin/sources, /admin/jobs, /admin/customers |
| API | /api/{health,estimates,catalog,sources,orders,orders/[id],subscriptions,admin/metrics,uploads,auth/*,payments/*,webhooks/stripe,connections/db-grant} |
Design system
Mono/editorial, light, radius 0, Inter + JetBrains Mono, single red #e40014, animated grain,
scroll-reveal motion. No photography — imagery is rendered data (DataArtifact). Every fact
shows a provenance square (ProvenanceBadge). Full spec: docs/05-design-system.md.
Run locally
pnpm install
pnpm dev # Next.js on http://localhost:3000
# data engine (separate, optional)
cd services/api && pip install -r requirements.txt && uvicorn orchestrator.main:app --reload
Deploy
- Frontend → Vercel (project
0pt, scope Simon Axelsson's projects), domain0pt.app. - Engine + DB + embeds → one VPS via
infra/docker-compose.yml(Postgres+pgvector, Redis, api, worker, NocoDB, Metabase, Caddy). - Env inventory:
.env.example. - Auth on
/api/0pt/*is fail-closed: withAUTH_ENFORCEunset the middleware REQUIRES a verified Zitadel Bearer token (401 without one). Only the literalAUTH_ENFORCE=falsedisables it, and that is refused whenNODE_ENV=production(the process throws at startup rather than serving anonymously).
Status
Frontend, full order lifecycle, customer + admin portals, edge API, payment/auth/embed infrastructure, the compliant data engine, schema and infra are all in place and building green. Integrations are env-guarded and activate when their keys/DB are provided:
- Database — Vercel → Storage → Postgres (sets
POSTGRES_URL) → durable persistence (schema insql/001_init.sql). - Stripe + Resend keys → payments + email.
- VPS for the engine → set
ENGINE_URL. AUTH_SECRET+DEV_LOGIN_KEY→ login (full OAuth via Auth.js lands with the DB).
© 2026 SIAX Technology AB. Not affiliated with Protosell.