feat: implement read-only mode for demo organization and add error handling #35
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,27 @@ | ||
| export default defineEventHandler(async (event) => { | ||
| try { | ||
| return await auth.handler(toWebRequest(event)) | ||
| } catch (error) { | ||
| const requestUrl = getRequestURL(event) | ||
| console.error('[Applirank] Auth handler error', { | ||
| method: event.method, | ||
| path: requestUrl.pathname, | ||
| message: error instanceof Error ? error.message : 'Unknown error', | ||
| stack: error instanceof Error ? error.stack : undefined, | ||
| }) | ||
|
|
||
| const exposeDetails = isRailwayPreviewEnvironment(env.RAILWAY_ENVIRONMENT_NAME) || import.meta.dev | ||
| const details = error instanceof Error ? error.message : 'Unknown error' | ||
|
|
||
| throw createError({ | ||
| statusCode: 500, | ||
| statusMessage: exposeDetails ? `Auth handler failed: ${details}` : 'Server Error', | ||
| data: exposeDetails | ||
| ? { | ||
| code: 'AUTH_HANDLER_ERROR', | ||
| message: details, | ||
| } | ||
| : undefined, | ||
| }) | ||
| } | ||
| }) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,10 @@ let _auth: Auth | undefined | |
|
|
||
| function resolveBetterAuthUrl(): string { | ||
| const explicitUrl = env.BETTER_AUTH_URL?.trim() | ||
| const railwayDomain = env.RAILWAY_PUBLIC_DOMAIN?.trim() | ||
| const hasPreviewDomain = railwayDomain ? railwayDomain.toLowerCase().includes('-pr-') : false | ||
| const hasPrNumber = !!env.RAILWAY_GIT_PR_NUMBER?.trim() | ||
| const isPreview = isRailwayPreviewEnvironment(env.RAILWAY_ENVIRONMENT_NAME) || hasPreviewDomain || hasPrNumber | ||
|
Comment on lines
+11
to
+14
There was a problem hiding this comment.
🛠️ Proposed fix — extend `superRefine` to mirror the same three-signal logic// server/utils/env.ts
.superRefine((data, ctx) => {
- const isPreview = isRailwayPreviewEnvironment(data.RAILWAY_ENVIRONMENT_NAME)
+ const hasPreviewDomain = data.RAILWAY_PUBLIC_DOMAIN?.toLowerCase().includes('-pr-') ?? false
+ const hasPrNumber = !!data.RAILWAY_GIT_PR_NUMBER
+ const isPreview =
+ isRailwayPreviewEnvironment(data.RAILWAY_ENVIRONMENT_NAME) ||
+ hasPreviewDomain ||
+ hasPrNumber
if (!isPreview && !data.BETTER_AUTH_URL) {🤖 Prompt for AI Agents |
||
|
|
||
| if (!isPreview) { | ||
| if (!explicitUrl) { | ||
|
|
@@ -25,7 +28,6 @@ function resolveBetterAuthUrl(): string { | |
| return previewUrl | ||
| } | ||
|
|
||
| if (railwayDomain) { | ||
| const previewUrl = `https://${railwayDomain}` | ||
| console.info(`[Applirank] Using Railway public-domain BETTER_AUTH_URL: ${previewUrl}`) | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,8 +23,11 @@ export function isRailwayPreviewEnvironment(environmentName?: string): boolean { | |
| if (name === 'production' || name === 'prod') return false | ||
|
|
||
| return ( | ||
| name.startsWith('pr') | ||
|
Comment on lines
25
to
+26
There was a problem hiding this comment.
Any environment name that starts with
The pre-existing 🛠️ Proposed fix — replace startsWith with a precise check return (
- name.startsWith('pr')
- ||
- /^pr(?:-|\d)/.test(name)
+ /^pr($|-|\d)/.test(name)
|| name.includes('pr-')
|| name.includes('pr ')🤖 Prompt for AI Agents |
||
| || | ||
| /^pr(?:-|\d)/.test(name) | ||
| || name.includes('pr-') | ||
| || name.includes('pr ') | ||
| || name.includes('pull request') | ||
| || name.includes('pull-request') | ||
| || name.includes('preview') | ||
|
|
@@ -55,11 +58,11 @@ const envSchema = z | |
| /** IP address of the trusted reverse proxy (e.g., Railway, Cloudflare). When set, X-Forwarded-For is trusted for rate limiting. */ | ||
| TRUSTED_PROXY_IP: z.string().min(1).optional(), | ||
| /** Slug of the demo organization. When set, write operations are blocked for this org. */ | ||
| DEMO_ORG_SLUG: emptyToUndefined.optional(), | ||
| /** Fine-grained GitHub PAT with Issues:write scope. When set (along with GITHUB_FEEDBACK_REPO), enables in-app feedback. */ | ||
| GITHUB_FEEDBACK_TOKEN: emptyToUndefined.pipe(z.string().min(1)).optional(), | ||
| /** GitHub repo in "owner/repo" format for feedback issues. */ | ||
| GITHUB_FEEDBACK_REPO: emptyToUndefined.pipe(z.string().regex(/^[^/]+\/[^/]+$/, 'Must be in "owner/repo" format')).optional(), | ||
| }) | ||
| .superRefine((data, ctx) => { | ||
| const isPreview = isRailwayPreviewEnvironment(data.RAILWAY_ENVIRONMENT_NAME) | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| const PREVIEW_READ_ONLY_MESSAGE = 'Preview mode — this action is disabled. Deploy your own instance to get full access.' | ||
|
|
||
| export function createPreviewReadOnlyError() { | ||
| return createError({ | ||
| statusCode: 403, | ||
| statusMessage: PREVIEW_READ_ONLY_MESSAGE, | ||
| data: { | ||
| code: 'PREVIEW_READ_ONLY', | ||
| message: PREVIEW_READ_ONLY_MESSAGE, | ||
| }, | ||
| }) | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Modifying this file conflicts with the stated policy for
server/api/auth/[...all].ts.The team's own guideline is: "Do not add auth guards to the Better Auth catch-all handler at
server/api/auth/[...all].tsand do not modify this file unless changing the auth mount path." This PR adds a try/catch wrapper without changing the auth mount path.If structured error handling for the auth handler is needed, consider wrapping it in a server plugin or h3 middleware that catches unhandled auth errors globally, rather than touching the catch-all route. Based on learnings,
server/api/auth/[...all].tsshould only be changed for auth mount path modifications.🤖 Prompt for AI Agents