Moheeb Zara
df6951c323
Invites - migration 029: space_invites.role (member_role enum, default 'member' — legacy invites and the spaces.invite_code path keep granting member). schema.sql + types/database.ts mirrored - lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may grant any role; board may grant anything except admin; nobody else. Privilege-escalation guard on top of the existing admin/board gate - createInvite/updateInvite take + enforce role via that guard; createInviteSchema/updateInviteSchema validate the enum - joinSpace applies the invite's granted role (validated), default member; uses_count/max_uses/expiry already enforced - invites panel: role picker (filtered to what the creator may grant), one-click "single use", per-invite role badge - space-scoped invite link /join/<space>?code=… via a presentational app/join/[space] landing that hands off to the proven /signup?invite= flow; /join added to middleware PUBLIC_ROUTES Audit hardening (from this pass's review) - /login now honors a validated same-origin ?next= (was hardcoded to /dashboard) so the public_auth form sign-in round-trips; OAuth threads next through the callback (which already honored it) - submitForm requires formId; submitFormSchema drops the now-ambiguous slug path (form slugs are per-space after 028). Both callers already pass formId. Tests updated 337 tests; build verified (Compiled successfully, exit 0). No deploy.
80 lines
2.1 KiB
TypeScript
80 lines
2.1 KiB
TypeScript
import { updateSession } from '@/lib/supabase/proxy'
|
|
import { createServerClient } from '@supabase/ssr'
|
|
import { NextResponse, type NextRequest } from 'next/server'
|
|
|
|
// Public routes are reachable without an authenticated session. The
|
|
// /resources subsite is the legacy hackerspace.sh content baked in; the
|
|
// five individual resource routes (/zine, /governance, /space-after-dark,
|
|
// /proposal-duel, /atlas) must keep these exact paths so existing deep
|
|
// links and bookmarks survive the domain switch-over.
|
|
const PUBLIC_ROUTES = [
|
|
'/',
|
|
'/login',
|
|
'/signup',
|
|
'/join',
|
|
'/auth',
|
|
'/api/health',
|
|
// Public form / waiver fill page. Only /f/[slug] lives here and must be
|
|
// reachable anonymously (the page serves only published public forms and
|
|
// submitForm enforces visibility). The /forms* management routes do NOT
|
|
// match the '/f/' prefix and stay auth-gated.
|
|
'/f',
|
|
'/resources',
|
|
'/zine',
|
|
'/governance',
|
|
'/space-after-dark',
|
|
'/proposal-duel',
|
|
'/atlas',
|
|
'/atlas.html',
|
|
]
|
|
|
|
export async function proxy(request: NextRequest) {
|
|
const { pathname } = request.nextUrl
|
|
|
|
// Always update session to refresh cookies
|
|
const response = await updateSession(request)
|
|
|
|
// Allow public routes through without auth check
|
|
const isPublic =
|
|
pathname === '/' ||
|
|
PUBLIC_ROUTES.some(r => pathname === r || pathname.startsWith(r + '/'))
|
|
|
|
if (isPublic) {
|
|
return response
|
|
}
|
|
|
|
// For protected routes, check auth
|
|
const supabase = createServerClient(
|
|
process.env.NEXT_PUBLIC_SUPABASE_URL!,
|
|
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
|
|
{
|
|
cookies: {
|
|
getAll() {
|
|
return request.cookies.getAll()
|
|
},
|
|
setAll(cookiesToSet) {
|
|
cookiesToSet.forEach(({ name, value, options }) =>
|
|
response.cookies.set(name, value, options)
|
|
)
|
|
},
|
|
},
|
|
}
|
|
)
|
|
|
|
const {
|
|
data: { user },
|
|
} = await supabase.auth.getUser()
|
|
|
|
if (!user) {
|
|
return NextResponse.redirect(new URL('/login', request.url))
|
|
}
|
|
|
|
return response
|
|
}
|
|
|
|
export const config = {
|
|
matcher: [
|
|
'/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
|
|
],
|
|
}
|