scriptoriumadmin/supermemory
1
0
Fork 0
mirror of https://github.com/supermemoryai/supermemory.git synced 2026-11-12 08:41:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(web): scope the guest ?view= bypass to the root route

Browse source 
The ?view=mcp public-route check ran before the /api/ auth gate with no
  pathname check, so any request could append ?view=mcp to skip the 401 and
  reach the web app's API handlers unauthenticated.

  Scope it to the root route, matching isPublicAppPage in
  components/ensure-workspace.tsx. view=integrations was already scoped this
  way, so the two checks collapse into one PUBLIC_ROOT_VIEWS lookup.
This commit is contained in:
SEPURI-SAI-KRISHNA 2026-08-17 17:53:14 +05:30
parent 5d2b5855fe
commit 4d828e2750
No known key found for this signature in database
GPG key ID: 25D0C31405D7250A
1 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
apps/web/middleware.ts
View file

@ -4,6 +4,10 @@ import { getPublicRequestUrl } from "@/lib/url-helpers"
const LOCAL_DEV_HOSTS = new Set(["localhost", "127.0.0.1", "::1"])
// Views that are public in guest mode. These are page views on the root route,
// selected by ?view= — see isPublicAppPage in components/ensure-workspace.tsx.
const PUBLIC_ROOT_VIEWS = new Set(["integrations", "mcp"])
function getAuthSessionCookie(request: Request): string | null {
return (
getSessionCookie(request) ??
@ -41,13 +45,15 @@ export default async function proxy(request: Request) {
return NextResponse.next()
}
// MCP setup page is public — no auth required
if (url.searchParams.get("view") === "mcp") {
return NextResponse.next()
}
// Integrations index is public in guest mode; actions still require login.
if (url.pathname === "/" && url.searchParams.get("view") === "integrations") {
// MCP setup and the integrations index are public in guest mode; actions
// still require login. The pathname check is load-bearing: this runs before
// the /api/ gate below, so matching ?view= on any path would also let
// "/api/<anything>?view=mcp" skip the 401 and reach the web app's own API
// handlers unauthenticated.
if (
url.pathname === "/" &&
PUBLIC_ROOT_VIEWS.has(url.searchParams.get("view") ?? "")
) {
return NextResponse.next()
}