From 9c447689affc62b763c5265e26cf231949a78954 Mon Sep 17 00:00:00 2001 From: dcccrypto Date: Wed, 2 Sep 2026 19:36:21 +0100 Subject: [PATCH] docs(#2342): the admin routes this middleware claims to protect no longer exist here MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #2342 asks for a middleware-level guard on /admin as defence-in-depth, on the grounds that "if any future admin route forgets to call requireAdminSession it's immediately exploitable without authentication". The premise does not hold, and the reason is worth writing down rather than just closing the issue. There is no admin surface in this repo any more: app/admin — does not exist app/api/admin/* — does not exist built route manifest — no /admin entry requireAdminSession — ZERO callers outside its own test The admin surface moved to the separate API service. So there is no route here to forget the check. What remains is worse than a gap in one specific way, which is what this commit fixes. The middleware still asserts: • Every /api/admin/* route gates on requireAdminSession(req) server-side, so even if the page leaked HTML the data is locked down. A reader checking that claim finds nothing to check. It is a security assurance about handlers that are not here — the same shape as nft#160's docs citing a LiteSVM suite that did not exist, and the parity spec naming a field the program had renamed. An assurance nobody can verify is worse than an absent one, because it stops the next person looking. The isAdminRoute branch is kept deliberately: if an /admin path is ever re-added, it inherits the security headers rather than silently skipping them. That is now stated as its actual purpose. Also recorded: a middleware guard could not have satisfied #2342 as asked anyway — the Privy session is attached by useAdminFetch as a header and cannot be verified in the Edge runtime without bundling the SDK, which is why the guard lives in the handlers in the first place. Launch suite: 3128 passed / 16 skipped / 0 failed. Refs: dcccrypto/percolator-launch#2342 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NgoNgagkvw7i5SSRC3FJ8D --- app/middleware.ts | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/app/middleware.ts b/app/middleware.ts index 18772fe0..b8b5db77 100644 --- a/app/middleware.ts +++ b/app/middleware.ts @@ -406,6 +406,25 @@ export async function middleware(request: NextRequest) { // • Every /api/admin/* route gates on requireAdminSession(req) server- // side, so even if the page leaked HTML the data is locked down. // + // #2342 / STATE AS OF 2026-09-02: NEITHER OF THOSE ROUTES EXISTS IN THIS REPO + // ANY MORE. There is no `app/admin` page and no `app/api/admin/*` handler — + // the built route manifest has no /admin entry, and `requireAdminSession` + // (lib/admin-session.ts) has zero callers outside its own test. The admin + // surface now lives in the separate API service. + // + // The branch below is dead for the routes it names, and is kept only so that + // an /admin path re-added here inherits the security headers rather than + // silently skipping them. + // + // Recorded because the two bullets above, read alone, assert that admin data + // "is locked down" by handlers in this repo — and a reader checking that claim + // would find nothing to check. #2342 asked for a middleware guard as + // defence-in-depth against a future route forgetting its own check. The + // accurate answer today is that there is no route here to forget, and the + // middleware cannot verify a Privy session in the Edge runtime anyway (see + // above). If admin routes return, add the guard WITH them — do not trust this + // comment to still be true. + // // We still attach the security headers + skip /admin/login from any host- // level redirects above. const isAdminRoute =