Jakob Wennberg
0fbb0f8fa8
The middleware matcher excluded the legacy manifest.json path, but the app serves its manifest from app/manifest.ts at /manifest.webmanifest. Browsers fetch manifests without credentials, so every manifest request hit the auth gate and 307-redirected to /login, making the PWA uninstallable for all users (logged in or not). Verified locally: /manifest.webmanifest returns 200 JSON, /dashboard still redirects to /login. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
24 lines
934 B
TypeScript
24 lines
934 B
TypeScript
import { type NextRequest } from 'next/server'
|
|
import { updateSession } from '@/lib/supabase/middleware'
|
|
|
|
export async function proxy(request: NextRequest) {
|
|
return await updateSession(request)
|
|
}
|
|
|
|
export const config = {
|
|
matcher: [
|
|
/*
|
|
* Match all request paths except for the ones starting with:
|
|
* - _next/static (static files)
|
|
* - _next/image (image optimization files)
|
|
* - favicon.ico (favicon file)
|
|
* - Static assets (images, scripts, manifest, icons, etc.)
|
|
*
|
|
* NOTE: `/api` is intentionally INCLUDED so the proxy can enforce the MFA
|
|
* (AAL2) gate on cookie-authenticated API calls (updateSession short-
|
|
* circuits API routes after that check: see lib/supabase/middleware.ts).
|
|
*/
|
|
'/((?!_next/static|_next/image|favicon.ico|\\.well-known|sw\\.js|sw-register\\.js|manifest\\.json|manifest\\.webmanifest|icons/|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|js|json)$).*)',
|
|
],
|
|
}
|