CI / quality (push) Has been cancelled
- Move admin login lockout from client cookie to AppConfig (DB), keyed by hashed client IP — clearing browser cookies no longer bypasses it - Replace rate-limit $transaction (TOCTOU) with atomic SQL INSERT...ON CONFLICT...RETURNING; add stale-entry cleanup on each submission to prevent table bloat - Add 5 s module-level cache for middleware runtime state fetch, reducing per-request DB roundtrips - Rename middleware.ts → proxy.ts to resolve Next.js 16 deprecation warning; update test import accordingly - Require ADMIN_PASSWORD, ADMIN_AUTH_SECRET, ADMIN_BASIC_AUTH_USER, and ADMIN_BASIC_AUTH_PASS in docker-compose.yml (:? syntax) — startup fails loudly instead of using placeholder defaults - Add set -e and informative echo lines to Dockerfile CMD for clearer startup failure attribution - Export requireAdminAuth() from lib/admin-auth for centralised use in admin pages - Add CLAUDE.md with architecture notes and working rules Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
150 lines
4.1 KiB
TypeScript
150 lines
4.1 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
const createMiddlewareMock = vi.fn();
|
|
const intlHandlerMock = vi.fn(() => NextResponse.next());
|
|
|
|
vi.mock("next-intl/middleware", () => ({
|
|
default: createMiddlewareMock,
|
|
}));
|
|
|
|
vi.mock("../lib/admin-routing", () => ({
|
|
fromDevelopmentAdminPath: (pathname: string) => pathname,
|
|
getAdminBaseUrl: () => "https://admin.example.com",
|
|
getRequestHostname: (_forwardedHost: string | null, host: string | null, hostname: string) => host ?? hostname,
|
|
isDevelopmentAdminPath: () => false,
|
|
isAdminHost: () => false,
|
|
hasDedicatedAdminHost: () => false,
|
|
isInternalAdminPath: () => false,
|
|
isLegacyAdminPath: () => false,
|
|
toInternalAdminPath: (pathname: string) => pathname,
|
|
}));
|
|
|
|
function createMockRequest(url: string) {
|
|
const nextUrl = new URL(url) as URL & { clone: () => URL };
|
|
nextUrl.clone = () => new URL(nextUrl.toString());
|
|
|
|
return {
|
|
url,
|
|
nextUrl,
|
|
headers: new Headers({
|
|
host: nextUrl.host,
|
|
}),
|
|
cookies: {
|
|
has: vi.fn(() => false),
|
|
},
|
|
};
|
|
}
|
|
|
|
describe("middleware locale runtime config", () => {
|
|
beforeEach(() => {
|
|
vi.resetModules();
|
|
process.env.NODE_ENV = "production";
|
|
delete process.env.SITE_RUNTIME_ORIGIN;
|
|
createMiddlewareMock.mockReset();
|
|
intlHandlerMock.mockReset();
|
|
intlHandlerMock.mockReturnValue(NextResponse.next());
|
|
createMiddlewareMock.mockReturnValue(intlHandlerMock);
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.unstubAllGlobals();
|
|
});
|
|
|
|
it("passes the runtime default locale into next-intl middleware", async () => {
|
|
vi.stubGlobal(
|
|
"fetch",
|
|
vi.fn(async () => ({
|
|
ok: true,
|
|
json: async () => ({
|
|
defaultLocale: "ar",
|
|
maintenanceEnabled: false,
|
|
}),
|
|
})),
|
|
);
|
|
|
|
const { default: middleware } = await import("../proxy");
|
|
const request = createMockRequest("https://example.com/");
|
|
|
|
await middleware(request as never);
|
|
|
|
expect(fetch).toHaveBeenCalledWith(
|
|
new URL("http://127.0.0.1:3000/api/site/default-locale"),
|
|
expect.any(Object),
|
|
);
|
|
expect(createMiddlewareMock).toHaveBeenCalledTimes(1);
|
|
expect(createMiddlewareMock).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
defaultLocale: "ar",
|
|
}),
|
|
);
|
|
expect(intlHandlerMock).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
it("falls back safely when the runtime locale lookup fails", async () => {
|
|
vi.stubGlobal(
|
|
"fetch",
|
|
vi.fn(async () => {
|
|
throw new Error("network failed");
|
|
}),
|
|
);
|
|
|
|
const { default: middleware } = await import("../proxy");
|
|
const request = createMockRequest("https://example.com/");
|
|
|
|
await middleware(request as never);
|
|
|
|
expect(createMiddlewareMock).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
defaultLocale: "de",
|
|
}),
|
|
);
|
|
});
|
|
|
|
it("redirects maintenance traffic using the runtime default locale", async () => {
|
|
vi.stubGlobal(
|
|
"fetch",
|
|
vi.fn(async () => ({
|
|
ok: true,
|
|
json: async () => ({
|
|
defaultLocale: "ar",
|
|
maintenanceEnabled: true,
|
|
}),
|
|
})),
|
|
);
|
|
|
|
const { default: middleware } = await import("../proxy");
|
|
const request = createMockRequest("https://example.com/");
|
|
|
|
const response = await middleware(request as never);
|
|
|
|
expect(response.headers.get("location")).toBe("https://example.com/coming-soon");
|
|
expect(intlHandlerMock).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("prefers the configured internal runtime origin when provided", async () => {
|
|
process.env.SITE_RUNTIME_ORIGIN = "http://app:3000";
|
|
|
|
vi.stubGlobal(
|
|
"fetch",
|
|
vi.fn(async () => ({
|
|
ok: true,
|
|
json: async () => ({
|
|
defaultLocale: "en",
|
|
maintenanceEnabled: false,
|
|
}),
|
|
})),
|
|
);
|
|
|
|
const { default: middleware } = await import("../proxy");
|
|
const request = createMockRequest("https://example.com/");
|
|
|
|
await middleware(request as never);
|
|
|
|
expect(fetch).toHaveBeenCalledWith(
|
|
new URL("http://app:3000/api/site/default-locale"),
|
|
expect.any(Object),
|
|
);
|
|
});
|
|
});
|