When a user renames their tunnel subdomain, the upsert (onConflict=user_id)
overwrote the tunnels row in place, but the old subdomain's Redis
tunnel:active:<sub> flag was never cleared. The edge tunnel-active gate kept
serving the stale flag for up to its ~30s TTL, after which it fell back to a
Postgres miss and (currently) returned a misleading suspended response.
Capture the user's previous subdomain before the upsert and, when it changes,
DEL the old kill-switch key (new clearTunnelActive helper) so the edge gate
immediately stops treating the old subdomain as a live tunnel.
@supabase/ssr derives the auth cookie storage key from the hostname of the URL
it is given (sb-<sub>-auth-token). After routing server-side clients at the
internal host (kong-prod), the server looked for sb-kong-prod-auth-token while
the browser had set sb-api-auth-token, so server-side getUser() never found the
just-established session and bounced the user off the MFA challenge back to
/login. Pin every client (browser, server, middleware) to the name derived from
NEXT_PUBLIC_SUPABASE_URL via a shared helper so the namespace stays consistent
regardless of which API endpoint the client talks to.
Server-side Supabase calls (middleware getUser/refresh, server components,
admin client) all egress through the Docker gateway as a single NATed IP and
traverse Caddy's per-IP /auth/* rate limiter (8 events/s). A handful of active
users saturate that shared bucket, 429ing getUser()/token refresh; the
middleware then treats the session as invalid and bounces to /login, while a
manual refresh lands under budget and works again.
Add SUPABASE_INTERNAL_URL (e.g. http://kong-prod:8000) used only by the
server-side clients (middleware, lib/supabase/server.ts, admin getSupabaseAdmin
/getSupabaseAnon), falling back to the public URL when unset. Browser clients
keep the public URL so real per-user-IP edge rate limiting still applies.
Also bake the arg in the Dockerfile/build and make the web-prod network alias
durable via WEB_ALIAS (dev sets web-dev) so the dev container can't reclaim the
web-prod alias on redeploy.
When getUser() rejects a present session cookie with user_not_found /
session_not_found / bad_jwt (e.g. a deleted account or a cookie that
outlived its session), the middleware now clears the sb-*-auth-token
cookies and redirects to /login instead of leaving the browser wedged
in a logged-out page that still renders a Sign out button.
- Add explicit viewport meta (device-width) for proper mobile scaling.
- Widen the main container (720 -> 960, 1120 on >=1280px) with fluid
clamp() padding so wide screens are used better.
- Wrap the top nav and allow it to reflow on narrow screens.
- Collapse the key/value grid to a single column and enlarge touch
targets on small screens.
- Keep single-form pages (login/signup/activate) in a readable narrow
column instead of stretching full width.
GoTrue v2.186 only loads MAILER_TEMPLATES_* over HTTP(S) (local file/file://
paths are rejected), so serve the token_hash confirmation template from the
app's public dir for GoTrue to fetch and cache.
- Add /auth/confirm GET route handler that verifies the signup token via
verifyOtp({ type, token_hash }) and falls back to exchangeCodeForSession
when a PKCE code is present. Whitelists to same-origin paths.
- Signup: pass emailRedirectTo=<APP_URL>/auth/confirm, show a
'check your email' confirmation state with a resend action (cooldown),
and handle the already-registered case.
- Login: detect email_not_confirmed and offer a resend-confirmation action;
surface verification_failed errors from the confirm route.
The upstream admin gateway deterministically truncates the first per-row
getUserById that immediately follows a request's auth check, yielding an
empty body the per-call retry cannot clear — so a couple of tunnel rows
showed owner_email '—' on every load regardless of retry or concurrency.
Replace the per-row getUserById fan-out with a single bounded listUsers
scan (same transient retry) that builds an id->email map and stops early
once every owner on the page is resolved. A single listUsers read does not
hit the truncation pattern, eliminating the dashes. Remove the now-unused
mapWithConcurrency helper and OWNER_EMAIL_CONCURRENCY constant.
The upstream admin gateway tolerates only a small concurrent burst; at
concurrency 4 the tail of the per-row getUserById fan-out was truncated
into empty bodies on every list load (deterministic '—'), and the retries
piled into the same throttle window. Measured 0 failures at concurrency 2
(and 1) versus consistent truncations at 4, so pin enrichment to 2.
A large concurrent burst of getUserById calls during the tunnels-list
email enrichment self-inflicts an upstream throttle (truncated/empty
bodies) that even the per-call retry can't fully escape, intermittently
rendering owner_email as '—'. Add mapWithConcurrency and resolve owner
emails at most a few at a time so each lookup stays inside the throttle
allowance; retry + null fallback preserved.
The defense-in-depth admin guard in middleware short-circuits before the
route handlers' jsonNoStore runs, so its 401/403 JSON denials (and auth
redirects) were served without Cache-Control: no-store. Stamp no-store in
withCookies so every admin deny/redirect response is non-cacheable,
completing Finding #4 for the middleware-originated admin responses.
image/container/network/project names now come from env (WEB_IMAGE,
WEB_CONTAINER, WEB_NETWORK, WEB_PROJECT) with prod values as defaults. Dev
supplies its values via the gitignored .env.production. Makes dev->main merge
safe (prod resolves to web/web:1.0.0/edge by default).
- image web-dev:1.0.0, container web-dev, network dev_edge
- NEXT_PUBLIC_* build args resolved from gitignored .env.production
(api-dev/app-dev URLs) so the dev bundle targets the dev API.
- ignore .env.production (dev secrets) in this branch.
Gerhard Scheikl
linumiq_net-user