admin
07a1cb7768
/ unconditionally redirected to /feed, gated entirely by proxy.ts's auth.protect() — so logged-out visitors AND social-media crawlers scraping og:image for link previews got bounced to Clerk's hosted sign-in before Next.js ever rendered this route's metadata (surfaced as Facebook Sharing Debugger's "og:image should be explicit" warning, since the crawler never saw our actual tags). Adds "/" to proxy.ts's public matcher and moves the authenticated-redirect into the page itself via a plain auth() read (not .protect()), so it can render a real hero page — matching the OG image's warm gradient + paw-mark visual language — for logged-out visitors and crawlers alike, while still bouncing authenticated users straight to /feed as before.
59 lines
1.7 KiB
TypeScript
59 lines
1.7 KiB
TypeScript
import { clerkMiddleware, createRouteMatcher } from "@clerk/nextjs/server";
|
|
import { NextResponse } from "next/server";
|
|
|
|
const isPublicRoute = createRouteMatcher([
|
|
"/",
|
|
"/sign-up(.*)",
|
|
"/log-in(.*)",
|
|
"/forgot-password(.*)",
|
|
"/reset-password(.*)",
|
|
"/verify-email(.*)",
|
|
"/health-card/(.*)",
|
|
"/api/gdpr-export/(.*)",
|
|
"/opengraph-image",
|
|
"/impressum",
|
|
"/datenschutz",
|
|
"/nutzungsbedingungen",
|
|
"/join(.*)",
|
|
"/api/webhooks/(.*)",
|
|
"/api/auth/(.*)",
|
|
"/api/cron/(.*)",
|
|
]);
|
|
|
|
export default clerkMiddleware(async (auth, request) => {
|
|
const { pathname } = request.nextUrl;
|
|
|
|
// Invite gate: block /sign-up unless the visitor has a valid invite cookie.
|
|
// Set INVITE_REQUIRED=false in env to disable for the live/post-beta launch.
|
|
if (pathname.startsWith("/sign-up")) {
|
|
const inviteRequired = process.env.INVITE_REQUIRED !== "false";
|
|
if (inviteRequired && !request.cookies.has("pf_invite")) {
|
|
return NextResponse.redirect(new URL("/join", request.url));
|
|
}
|
|
}
|
|
|
|
// Admin panel: validate secret path segment before anything else.
|
|
// Returns 404 (not 403) — the panel's existence must not be revealed.
|
|
if (pathname.startsWith("/p/")) {
|
|
const segments = pathname.split("/");
|
|
const providedSecret = segments[2] ?? "";
|
|
const adminSecret = process.env.ADMIN_SECRET ?? "";
|
|
|
|
if (!adminSecret || providedSecret !== adminSecret) {
|
|
return new NextResponse(null, { status: 404 });
|
|
}
|
|
}
|
|
|
|
if (!isPublicRoute(request)) {
|
|
await auth.protect();
|
|
}
|
|
});
|
|
|
|
export const config = {
|
|
matcher: [
|
|
"/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)",
|
|
"/(api|trpc)(.*)",
|
|
"/__clerk/(.*)",
|
|
],
|
|
};
|