bjornbergenheim
f101bde6a8
The image is built once with sentinel values
(ENV NEXT_PUBLIC_SELF_HOSTED=__NEXT_PUBLIC_SELF_HOSTED__) that
docker-entrypoint.sh seds into .next at container start. Comparing a flag in
place defeats that: the bundler inlines the sentinel, the minifier folds
"__NEXT_PUBLIC_SELF_HOSTED__" === 'true' to false and eliminates the branch, so
both the variable name and the sentinel disappear and sed has nothing left to
replace. The flag is then permanently false whatever the operator configures.
Diagnosed against a running self-hosted instance: the compiled gate read
function r(){return"true"!==process.env.FORCE_PAYWALL
&&"true"===process.env.DISABLE_PAYWALL}
with the isSelfHosted() branch gone. The un-prefixed FORCE_PAYWALL /
DISABLE_PAYWALL survived precisely because they are never inlined, and
NODE_ENV === 'development' was folded away by the same mechanism. The one
place the flag still worked, getSessionTimeoutConfig(env = process.env), reads
it off a parameter the bundler cannot fold.
Consequence: every Docker self-host ran with the entitlement paywall live, so
ai, bank_sync, skatteverket and email_send went dark 30 days after company
creation when the seeded trial grants expired. Nothing surfaced it, because
dev and the Vercel build both have real env values and never reproduce it.
Analytics, forced MFA, BankID and the hosted upload ceiling read the same flag
and were wrong in the same direction.
Flags are now read as values through lib/env/public-flags, which keeps the
sentinel in the output as a live string literal and defers the comparison to
runtime. flagEnabled uses a Set lookup rather than ===, which a minifier could
fold if it ever inlined the helper.
Guarded twice, because the source fix alone would not have caught this:
- check:guards folded-public-flag fails any in-place NEXT_PUBLIC_* comparison
(AST, no baseline, verified to fire on a probe file);
- docker-publish asserts the sentinels survive the built image, which is the
only artifact where the failure is observable.
npm test 14999 passed, npm run lint 0 errors, npm run check:guards clean.
Signed-off-by: Bjorn Bergenheim <29535152+bjornbergenheim@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
66 lines
3.0 KiB
TypeScript
66 lines
3.0 KiB
TypeScript
/**
|
|
* Runtime reads of `NEXT_PUBLIC_*` boolean flags.
|
|
*
|
|
* The Docker image is generic: it is built once with sentinel values
|
|
* (`ENV NEXT_PUBLIC_SELF_HOSTED=__NEXT_PUBLIC_SELF_HOSTED__` in the Dockerfile)
|
|
* and `docker-entrypoint.sh` seds the operator's real values into `.next` at
|
|
* container start. That contract has one requirement nobody wrote down: the
|
|
* sentinel must still BE in the build output for sed to find.
|
|
*
|
|
* Writing `process.env.NEXT_PUBLIC_SELF_HOSTED === 'true'` breaks it. The
|
|
* bundler inlines the sentinel, leaving `"__NEXT_PUBLIC_SELF_HOSTED__" ===
|
|
* 'true'`, which the minifier constant-folds to `false` and then
|
|
* dead-code-eliminates. Variable name and sentinel both disappear, sed has
|
|
* nothing to replace, and the flag is permanently false no matter what the
|
|
* operator configures.
|
|
*
|
|
* That shipped: every Docker self-host ran with the entitlement paywall live,
|
|
* so `ai`, `bank_sync`, `skatteverket` and `email_send` went dark 30 days after
|
|
* company creation (diagnosed 2026-08-17 against a running NAS instance, where
|
|
* the compiled gate read `function r(){return"true"!==process.env.FORCE_PAYWALL
|
|
* &&"true"===process.env.DISABLE_PAYWALL}` with the self-hosted branch gone).
|
|
* The un-prefixed `FORCE_PAYWALL`/`DISABLE_PAYWALL` survived precisely because
|
|
* they are never inlined.
|
|
*
|
|
* The fix is to keep the sentinel out of a foldable comparison. Reading it as a
|
|
* VALUE (a function argument) preserves the string literal in the bundle; the
|
|
* comparison then happens at runtime, after sed has done its work. The Set
|
|
* lookup is the belt to that suspenders: a minifier can fold `x === 'true'`,
|
|
* but not `SET.has(x)`.
|
|
*
|
|
* Use `flagEnabled(process.env.NEXT_PUBLIC_WHATEVER)` for any public boolean
|
|
* flag. `scripts/checks/no-new-antipatterns.mjs` (folded-public-flag) fails the
|
|
* build on a direct comparison so this cannot regress silently again.
|
|
*/
|
|
|
|
/**
|
|
* Values that mean "on". Deliberately a Set: `x === 'true'` is foldable when
|
|
* `x` is a build-time constant, `TRUTHY_VALUES.has(x)` is not.
|
|
*/
|
|
const TRUTHY_VALUES = new Set(['true'])
|
|
|
|
/**
|
|
* Whether a `NEXT_PUBLIC_*` flag is switched on.
|
|
*
|
|
* Pass the env read as an argument, never compare it in place:
|
|
*
|
|
* flagEnabled(process.env.NEXT_PUBLIC_BANKID_ENABLED) // correct
|
|
* process.env.NEXT_PUBLIC_BANKID_ENABLED === 'true' // folded away in Docker
|
|
*/
|
|
export function flagEnabled(value: string | undefined): boolean {
|
|
return value !== undefined && TRUTHY_VALUES.has(value)
|
|
}
|
|
|
|
/**
|
|
* Whether this is a self-hosted deployment (Docker), as opposed to the hosted
|
|
* product. Self-hosted disables forced MFA, session timeouts, analytics and the
|
|
* entitlement paywall, and lifts the hosted upload ceiling.
|
|
*
|
|
* Named accessor rather than a bare `flagEnabled` call because five modules ask
|
|
* this same question and the answer decides legal-ish behaviour (what an AGPL
|
|
* operator's own instance is allowed to do without paying us).
|
|
*/
|
|
export function isSelfHosted(): boolean {
|
|
return flagEnabled(process.env.NEXT_PUBLIC_SELF_HOSTED)
|
|
}
|