Gerhard Scheikl 1adb6e7b3f fix(admin): no-store on middleware admin deny/redirect responses ...

The defense-in-depth admin guard in middleware short-circuits before the
route handlers' jsonNoStore runs, so its 401/403 JSON denials (and auth
redirects) were served without Cache-Control: no-store. Stamp no-store in
withCookies so every admin deny/redirect response is non-cacheable,
completing Finding #4 for the middleware-originated admin responses.

2026-05-31 13:51:25 +02:00

app

fix(admin): return 404 (not 500) when deleting an already-removed user

2026-05-31 13:23:43 +02:00

lib

fix(admin): fresh SSR reads, atomic user delete + sanitized errors, cookie-rotation in middleware, no-store on admin APIs

2026-05-31 13:15:56 +02:00

public

initial commit

2026-05-29 17:07:00 +02:00

supabase/migrations

feat(admin): comprehensive admin interface (users, tunnels, metrics, audit, reserved subdomains)

2026-05-31 10:58:23 +02:00

.dockerignore

initial commit

2026-05-29 17:07:00 +02:00

.env

initial commit

2026-05-29 17:07:00 +02:00

.gitignore

feat(admin): comprehensive admin interface (users, tunnels, metrics, audit, reserved subdomains)

2026-05-31 10:58:23 +02:00

docker-compose.yml

security-update

2026-05-31 10:19:06 +02:00

Dockerfile

initial commit

2026-05-29 17:07:00 +02:00

middleware.ts

fix(admin): no-store on middleware admin deny/redirect responses

2026-05-31 13:51:25 +02:00

next-env.d.ts

initial commit

2026-05-29 17:07:00 +02:00

next.config.mjs

initial commit

2026-05-29 17:07:00 +02:00

package-lock.json

fix(admin): key tunnels by user_id, server-side initial list load, full-scan user search

2026-05-31 11:46:14 +02:00

package.json

initial commit

2026-05-29 17:07:00 +02:00

tsconfig.json

initial commit

2026-05-29 17:07:00 +02:00

S

Description

No description provided

338 KiB

Languages

TypeScript 95.7%

CSS 3.5%

Dockerfile 0.6%

HTML 0.1%