0pt/middleware.ts

/**
 * `middleware.ts` -- Next.js request middleware = 0pt's framework-level auth
 * seam (the Next analog of a Fastify `onRequest` hook).
 *
 * This runs the Zitadel verification (src/auth/context.ts ->
 * src/auth/zitadel.ts) in front of every 0pt capability route (/api/0pt/*).
 * It does NOT touch the v0-generated UI routes or the unrelated
 * payment/order APIs (see the matcher below and the note in the PR that
 * introduced the fail-closed default).
 *
 *   AUTH_ENFORCE unset, or anything except "false" (DEFAULT, enforced):
 *     a valid verified token is required; 401 on missing/invalid, 403 when
 *     X-Tenant-Id disagrees with the token tenant. On success the verified
 *     principal is forwarded to the handler as `x-0pt-verified-sub` /
 *     `x-0pt-verified-tenant` request headers.
 *   AUTH_ENFORCE == "false" (explicit local-dev escape hatch): never rejects.
 *     REFUSED in production -- `assertAuthConfigSafe()` below throws at module
 *     load, so a production instance cannot boot with auth switched off.
 *
 * Health/metrics are exempt (they are also outside the matcher below, but the
 * exemption is kept explicit for robustness).
 *
 * FIX (2026-08-31): matcher now covers BOTH /api/0pt (exact) and /api/0pt/:path*
 * to close the gap where a bare GET /api/0pt (no trailing path) was routed around
 * the middleware on Vercel's Edge runtime.
 *
 * FIX (P014): one route under this matcher, /api/0pt/quality/bridge-run, is
 * not called by a customer's Zitadel-authenticated session at all -- it is
 * called BY the Python engine (services/api/workers/quality_bridge.py) using
 * the pre-existing X-Internal-Token shared-secret convention, never a Bearer
 * token. Before this fix, that meant middleware always rejected the engine's
 * real call with 401 (see src/auth/internal-token.ts's doc comment for the
 * full story) -- the quality bridge was permanently unreachable in any
 * environment enforcing auth. INTERNAL_ONLY_ROUTES lets a request to that
 * ONE path through on a verified X-Internal-Token instead of a Bearer token;
 * every other /api/0pt/* route is untouched and still requires the normal
 * Zitadel flow below. A request to that route WITHOUT a valid internal token
 * still falls through to the ordinary Bearer check (e.g. an operator testing
 * it manually with their own token), it is not a blanket bypass.
 */

import { NextResponse, type NextRequest } from 'next/server';
import { assertAuthConfigSafe, resolveAuthContext } from '@/src/auth/context';
import { verifyInternalServiceToken } from '@/src/auth/internal-token';

// STARTUP GATE: fail to boot rather than serve /api/0pt/* openly in production.
assertAuthConfigSafe();

// Only guard the 0pt capability surface. The matcher keeps this middleware off
// the UI, auth, and payment routes entirely.
export const config = {
  matcher: ['/api/0pt', '/api/0pt/:path*'],
};

const EXEMPT_PATTERNS: RegExp[] = [
  /^\/api\/health(\/|$)/,
  /^\/api\/ready(\/|$)/,
  /^\/api\/admin\/metrics(\/|$)/,
];

/** The one 0pt route reached by a service (the Python engine), not a user session. */
const INTERNAL_ONLY_ROUTES: RegExp[] = [/^\/api\/0pt\/quality\/bridge-run$/];

// Module-level diagnostics counter — first 5 auth requests in a process lifetime
// log their outcome so the production auth gap (S1) can be traced to root cause.
let _authDiagCount = 0;

export async function middleware(req: NextRequest): Promise<NextResponse> {
  const path = req.nextUrl.pathname;
  if (EXEMPT_PATTERNS.some((re) => re.test(path))) {
    return NextResponse.next();
  }

  if (INTERNAL_ONLY_ROUTES.some((re) => re.test(path)) && verifyInternalServiceToken(req.headers)) {
    // Machine-to-machine call, verified via the shared X-Internal-Token
    // secret rather than a user's Bearer token. Deliberately does NOT set
    // x-0pt-verified-* headers -- there is no per-user principal here, and
    // the route requires+validates tenant_id from its own request body
    // (qualityBridgeRunSchema), which is the actual tenant the engine is
    // running the order for.
    return NextResponse.next();
  }

  if (_authDiagCount < 5) {
    _authDiagCount += 1;
    const hasAuth = !!req.headers.get('authorization');
    console.log(
      `[0pt-auth] middleware path=${path} auth_header=${hasAuth} ` +
      `auth_enforce=${process.env.AUTH_ENFORCE ?? 'unset'} ` +
      `node_env=${process.env.NODE_ENV ?? 'unset'} request#${_authDiagCount}`,
    );
  }

  const decision = await resolveAuthContext(req.headers);

  if (!decision.ok) {
    return NextResponse.json(
      { error: decision.code, message: decision.message, ...(decision.details ? { details: decision.details } : {}) },
      { status: decision.status },
    );
  }

  const principal = decision.ctx.principal;
  if (principal) {
    const forwarded = new Headers(req.headers);
    forwarded.set('x-0pt-verified-sub', principal.sub);
    forwarded.set('x-0pt-verified-tenant', principal.tenantId);
    return NextResponse.next({ request: { headers: forwarded } });
  }

  return NextResponse.next();
}