85 lines
3.2 KiB
TypeScript
85 lines
3.2 KiB
TypeScript
/**
|
|
* `middleware.ts` -- Next.js request middleware = 0pt's framework-level auth
|
|
* seam (the Next analog of a Fastify `onRequest` hook).
|
|
*
|
|
* This runs the Zitadel verification (src/auth/context.ts ->
|
|
* src/auth/zitadel.ts) in front of every 0pt capability route (/api/0pt/*).
|
|
* It does NOT touch the v0-generated UI routes or the unrelated
|
|
* payment/order APIs (see the matcher below and the note in the PR that
|
|
* introduced the fail-closed default).
|
|
*
|
|
* AUTH_ENFORCE unset, or anything except "false" (DEFAULT, enforced):
|
|
* a valid verified token is required; 401 on missing/invalid, 403 when
|
|
* X-Tenant-Id disagrees with the token tenant. On success the verified
|
|
* principal is forwarded to the handler as `x-0pt-verified-sub` /
|
|
* `x-0pt-verified-tenant` request headers.
|
|
* AUTH_ENFORCE == "false" (explicit local-dev escape hatch): never rejects.
|
|
* REFUSED in production -- `assertAuthConfigSafe()` below throws at module
|
|
* load, so a production instance cannot boot with auth switched off.
|
|
*
|
|
* Health/metrics are exempt (they are also outside the matcher below, but the
|
|
* exemption is kept explicit for robustness).
|
|
*
|
|
* FIX (2026-08-31): matcher now covers BOTH /api/0pt (exact) and /api/0pt/:path*
|
|
* to close the gap where a bare GET /api/0pt (no trailing path) was routed around
|
|
* the middleware on Vercel's Edge runtime.
|
|
*/
|
|
|
|
import { NextResponse, type NextRequest } from 'next/server';
|
|
import { assertAuthConfigSafe, resolveAuthContext } from '@/src/auth/context';
|
|
|
|
// STARTUP GATE: fail to boot rather than serve /api/0pt/* openly in production.
|
|
assertAuthConfigSafe();
|
|
|
|
// Only guard the 0pt capability surface. The matcher keeps this middleware off
|
|
// the UI, auth, and payment routes entirely.
|
|
export const config = {
|
|
matcher: ['/api/0pt', '/api/0pt/:path*'],
|
|
};
|
|
|
|
const EXEMPT_PATTERNS: RegExp[] = [
|
|
/^\/api\/health(\/|$)/,
|
|
/^\/api\/ready(\/|$)/,
|
|
/^\/api\/admin\/metrics(\/|$)/,
|
|
];
|
|
|
|
// Module-level diagnostics counter — first 5 auth requests in a process lifetime
|
|
// log their outcome so the production auth gap (S1) can be traced to root cause.
|
|
let _authDiagCount = 0;
|
|
|
|
export async function middleware(req: NextRequest): Promise<NextResponse> {
|
|
const path = req.nextUrl.pathname;
|
|
if (EXEMPT_PATTERNS.some((re) => re.test(path))) {
|
|
return NextResponse.next();
|
|
}
|
|
|
|
if (_authDiagCount < 5) {
|
|
_authDiagCount += 1;
|
|
const hasAuth = !!req.headers.get('authorization');
|
|
console.log(
|
|
`[0pt-auth] middleware path=${path} auth_header=${hasAuth} ` +
|
|
`auth_enforce=${process.env.AUTH_ENFORCE ?? 'unset'} ` +
|
|
`node_env=${process.env.NODE_ENV ?? 'unset'} request#${_authDiagCount}`,
|
|
);
|
|
}
|
|
|
|
const decision = await resolveAuthContext(req.headers);
|
|
|
|
if (!decision.ok) {
|
|
return NextResponse.json(
|
|
{ error: decision.code, message: decision.message, ...(decision.details ? { details: decision.details } : {}) },
|
|
{ status: decision.status },
|
|
);
|
|
}
|
|
|
|
const principal = decision.ctx.principal;
|
|
if (principal) {
|
|
const forwarded = new Headers(req.headers);
|
|
forwarded.set('x-0pt-verified-sub', principal.sub);
|
|
forwarded.set('x-0pt-verified-tenant', principal.tenantId);
|
|
return NextResponse.next({ request: { headers: forwarded } });
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|