Move auth server-side + fix reload-from-file-source - #1
Merged
Conversation
…leware gate Replaces the client-side AuthGuard whose credentials were hardcoded in a public repo. Login posts to /api/login which checks AUTH_USER/AUTH_PASS and sets an HMAC-signed session cookie; middleware verifies it for every page and fails closed. Credentials no longer ship in the client bundle. Requires AUTH_USER, AUTH_PASS, AUTH_SECRET env vars on Vercel before deploy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…e reload priority
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AUTH_USER,AUTH_PASS,AUTH_SECRET), signed HttpOnly session cookie via HMAC-SHA256, Next.js middleware gate (fail-closed — redirects to/loginif secret is missing)src/lib/reloadSource.ts+ comprehensive test suite (235 LOC, 51 tests passing)Gates passed
npm run test→ 51 passed / 4 skipped ✓npm run build→ Compiled successfully, all 6 routes generated ✓BLOCKER — do not merge until resolved
vercel env lsshows zero production environment variables for this project.The auth middleware requires three secrets to be added to Vercel before merge:
AUTH_USERAUTH_PASSAUTH_SECRETWithout these, production deploys fail-closed: every page redirects to
/loginand the login API returns HTTP 500 "Auth is not configured on the server".To unblock: run
vercel env add AUTH_USER production, repeat forAUTH_PASSandAUTH_SECRET, then merge this PR.Test plan
vercel env addthe three secrets (Production environment)curl -I https://formforge.thegridbase.com/→ expect redirect to/login(not 500)/(200)🤖 Generated with Claude Code