Arnaud
a1a11ff5e5
Mirrors the existing recipe public-share pattern (/r/[id], gated by a visibility flag, no auth required) — shopping lists previously only supported private per-user collaborator invites (email + viewer/editor role), with no way to hand someone a link who isn't already a member. - shoppingLists.isPublic (owner-only toggle, same access-control pattern already used for renaming/deleting the list). - New public /s/[id] route added to PUBLIC_PATHS — read-only aisle-grouped view with a signup CTA for logged-out visitors, styled after /r/[id]. - The existing collaborator-invite dialog (ShareShoppingListButton) now also has a "Public link" toggle + copy-link button at the top, so there's one Share entry point for both private and public sharing. Verified locally: toggling public via the real dialog UI persists correctly (confirmed via DB + a fresh curl PATCH to rule out a client race in my own test script), and the public link loads with zero auth for a logged-out browser context.
40 lines
1.3 KiB
TypeScript
40 lines
1.3 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { getSessionCookie } from "better-auth/cookies";
|
|
|
|
const PUBLIC_PATHS = ["/login", "/signup", "/verify-email", "/forgot-password", "/reset-password", "/api/auth", "/r/", "/u/", "/s/", "/docs", "/api/v1/openapi.json", "/api/webhooks", "/api/v1/invites/", "/api/internal/"];
|
|
const ADMIN_PATHS = ["/admin"];
|
|
|
|
export async function proxy(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
|
|
const isPublic = PUBLIC_PATHS.some((p) => pathname.startsWith(p));
|
|
const isAdmin = ADMIN_PATHS.some((p) => pathname.startsWith(p));
|
|
const isApi = pathname.startsWith("/api/v1");
|
|
|
|
if (isPublic) return NextResponse.next();
|
|
|
|
const sessionCookie = getSessionCookie(request);
|
|
|
|
if (!sessionCookie) {
|
|
if (isApi) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
return NextResponse.redirect(new URL("/login", request.url));
|
|
}
|
|
|
|
if (isAdmin) {
|
|
// Role check happens inside admin pages — middleware only checks auth
|
|
// Full role verification requires DB lookup, done server-side in admin layout
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|
|
|
|
export default proxy;
|
|
|
|
export const config = {
|
|
matcher: [
|
|
"/((?!_next/static|_next/image|favicon.ico|icon.svg|icon-192.svg|icon-512.svg|manifest.webmanifest|sw.js|public/).*)",
|
|
],
|
|
};
|