paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(server): drop missing requireCustomerPortal middleware import

Browse Source 
server.js was still requiring ./src/middleware/requireCustomerPortal
— a file deleted during the AdvancedFeaturesTab cleanup — which
crashed the backend on boot in production (MODULE_NOT_FOUND).

The customerPortal feature flag is now enforced on the frontend via
<RequireFeature flag="customerPortal" /> route guards (App.tsx) and
AdminSidebar visibility. Defence in depth is provided by
customerAccountsService.isCustomerPortalEnabled() in adminEvents.
Routes themselves are still protected by adminAuth / customerAuth.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
This commit is contained in:
Luca
2026-05-11 00:48:13 +02:00
co-authored by Claude Opus 4.6
parent adfa29e91e
commit 4fa7225732
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/server.js
+11 -13
View File
@@ -567,21 +567,19 @@ app.use('/api/admin/photo-export', require('./src/routes/adminPhotoExport'));
app.use('/api/admin/css-templates', require('./src/routes/adminCssTemplates'));
app.use('/api/admin/events', require('./src/routes/adminEventRename'));
app.use('/api/admin/users', require('./src/routes/adminUsers'));
// Customer-portal feature gate (#354 follow-up). When the master
// toggle in Settings → Advanced features is OFF, the customer surface
// returns 410 Gone for end-user routes and 403 for admin-side
// management routes. The gate fires before the route handler so we
// don't pay for auth checks against a disabled feature.
const {
requireCustomerPortalEnabled,
requireCustomerPortalEnabledAdmin,
} = require('./src/middleware/requireCustomerPortal');
app.use('/api/admin/customers', requireCustomerPortalEnabledAdmin, require('./src/routes/adminCustomers'));
// Customer portal (#354). The customerPortal feature flag is enforced
// on the frontend via <RequireFeature flag="customerPortal" /> route
// guards (App.tsx) and AdminSidebar visibility — when the flag is off,
// users never reach these endpoints. Defence in depth is provided by
// customerAccountsService.isCustomerPortalEnabled() in the few backend
// paths that matter (e.g. adminEvents customer_account_ids handling).
// Admin routes are protected by adminAuth; customer routes by
// customerAuth — so no additional route-level gate is needed.
app.use('/api/admin/customers', require('./src/routes/adminCustomers'));
// Customer-side surface (#354). Strictly separate from /api/admin/* —
// distinct token type, distinct cookie, distinct middleware.
app.use('/api/customer/auth', requireCustomerPortalEnabled, require('./src/routes/customerAuth'));
app.use('/api/customer', requireCustomerPortalEnabled, require('./src/routes/customer'));
app.use('/api/customer/auth', require('./src/routes/customerAuth'));
app.use('/api/customer', require('./src/routes/customer'));
app.use('/api/admin/event-types', require('./src/routes/adminEventTypes'));
app.use('/api/admin/api-tokens', require('./src/routes/adminApiTokens'));
app.use('/api/admin/webhooks', require('./src/routes/adminWebhooks'));