fix: block staging backend on production white-label hosts (#1903)

* fix: block staging backend on production brands

* fix: clarify production domain classification

* fix: alert on forbidden white-label backend

proxy.ts

@@ -1,7 +1,32 @@
-import { type NextRequest } from 'next/server'
+import { NextResponse, type NextRequest } from 'next/server'
+import { usesForbiddenWhiteLabelBackend } from '@/lib/domains/production-white-label-backend'
+import { createLogger } from '@/lib/logger'
 import { updateSession } from '@/lib/supabase/middleware'
 
+const log = createLogger('proxy')
+
 export async function proxy(request: NextRequest) {
+  if (
+    usesForbiddenWhiteLabelBackend(
+      request.nextUrl.hostname,
+      process.env.NEXT_PUBLIC_SUPABASE_URL,
+    )
+  ) {
+    log.error('Blocked production white-label host from staging backend', {
+      alert: true,
+      operation: 'white_label_backend_guard',
+      requestHostname: request.nextUrl.hostname,
+      backendClassification: 'staging',
+    })
+
+    return new NextResponse(null, {
+      status: 503,
+      headers: {
+        'Cache-Control': 'no-store',
+      },
+    })
+  }
+
   return await updateSession(request)
 }