makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden authentication and writable endpoints

Browse source
This commit is contained in:
makearmy 2026-07-09 22:10:26 -04:00
parent c034824338
commit 0a7ee5ff35
33 changed files with 308 additions and 284 deletions
Download patch file Download diff file Expand all files Collapse all files

7
app/middleware.ts
View file

@ -16,8 +16,7 @@ import { NextResponse, NextRequest } from "next/server";
* Keep this list tiny; add broad /api/webhooks to allow ALL webhook endpoints.
*/
const PUBLIC_API_PREFIXES: string[] = [
"/api/auth", // login/refresh/callback endpoints
"/api/webhooks", // allow ALL webhook endpoints
"/api/auth/", // login/refresh/callback endpoints
];
/** Directus base (used to remotely validate the token after restarts). */
@ -86,8 +85,8 @@ import { NextResponse, NextRequest } from "next/server";
const url = req.nextUrl.clone();
const { pathname } = url;
// ── -1) Always allow ALL webhook endpoints
if (pathname === "/api/webhooks" || pathname.startsWith("/api/webhooks/")) {
// ── -1) Allow only the explicitly configured external webhook.
if (pathname === "/api/webhooks/kofi") {
return NextResponse.next();
}