From 4fa72257329942a6b598fa90c83c6bca7586fe33 Mon Sep 17 00:00:00 2001
From: Luca <102960244+Luca-Timo@users.noreply.github.com>
Date: Mon, 11 May 2026 00:48:13 +0200
Subject: [PATCH] fix(server): drop missing requireCustomerPortal middleware
 import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

server.js was still requiring ./src/middleware/requireCustomerPortal
— a file deleted during the AdvancedFeaturesTab cleanup — which
crashed the backend on boot in production (MODULE_NOT_FOUND).

The customerPortal feature flag is now enforced on the frontend via
<RequireFeature flag="customerPortal" /> route guards (App.tsx) and
AdminSidebar visibility. Defence in depth is provided by
customerAccountsService.isCustomerPortalEnabled() in adminEvents.
Routes themselves are still protected by adminAuth / customerAuth.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 backend/server.js | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/backend/server.js b/backend/server.js
index a56f48da..72790922 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -567,21 +567,19 @@ app.use('/api/admin/photo-export', require('./src/routes/adminPhotoExport'));
 app.use('/api/admin/css-templates', require('./src/routes/adminCssTemplates'));
 app.use('/api/admin/events', require('./src/routes/adminEventRename'));
 app.use('/api/admin/users', require('./src/routes/adminUsers'));
-// Customer-portal feature gate (#354 follow-up). When the master
-// toggle in Settings → Advanced features is OFF, the customer surface
-// returns 410 Gone for end-user routes and 403 for admin-side
-// management routes. The gate fires before the route handler so we
-// don't pay for auth checks against a disabled feature.
-const {
-  requireCustomerPortalEnabled,
-  requireCustomerPortalEnabledAdmin,
-} = require('./src/middleware/requireCustomerPortal');
-
-app.use('/api/admin/customers', requireCustomerPortalEnabledAdmin, require('./src/routes/adminCustomers'));
+// Customer portal (#354). The customerPortal feature flag is enforced
+// on the frontend via <RequireFeature flag="customerPortal" /> route
+// guards (App.tsx) and AdminSidebar visibility — when the flag is off,
+// users never reach these endpoints. Defence in depth is provided by
+// customerAccountsService.isCustomerPortalEnabled() in the few backend
+// paths that matter (e.g. adminEvents customer_account_ids handling).
+// Admin routes are protected by adminAuth; customer routes by
+// customerAuth — so no additional route-level gate is needed.
+app.use('/api/admin/customers', require('./src/routes/adminCustomers'));
 // Customer-side surface (#354). Strictly separate from /api/admin/* —
 // distinct token type, distinct cookie, distinct middleware.
-app.use('/api/customer/auth', requireCustomerPortalEnabled, require('./src/routes/customerAuth'));
-app.use('/api/customer', requireCustomerPortalEnabled, require('./src/routes/customer'));
+app.use('/api/customer/auth', require('./src/routes/customerAuth'));
+app.use('/api/customer', require('./src/routes/customer'));
 app.use('/api/admin/event-types', require('./src/routes/adminEventTypes'));
 app.use('/api/admin/api-tokens', require('./src/routes/adminApiTokens'));
 app.use('/api/admin/webhooks', require('./src/routes/adminWebhooks'));