fe3f91c7ef
Actually ran this for the first time. Three real bugs + two polish items.
1. NextAuth catch-all was eating local-auth routes
src/app/api/auth/[...nextauth]/route.ts is a catch-all that claims
everything under /api/auth/*. When AUTH_SECRET is set (i.e. outside
of DEV_BYPASS_AUTH), NextAuth's handlers absorbed my static
/api/auth/login, /api/auth/change-password etc. routes and returned
404 for them.
→ Moved to /api/local-auth/*. Updated all four client pages to
match. Added /api/local-auth to the middleware's authn-bypass
allow-list alongside /api/auth.
2. XLSX header matcher too greedy on "team"
The HEADER_MATCHERS entry for clientTeamRaw was ["team"], and
findIndex used substring match. That matched "Creative Team Member
Deliverable is Assigned to" (assignee column) BEFORE the literal
"Team" column. Result: client-team values on imported projects were
the assignee names ("gabrielle", "matt", "sergio").
→ Two-pass buildColumnMap: exact equality first (claims the
literal "Team" cell for clientTeamRaw), substring fallback second
(handles the verbose "Creative Team Member…" header for assignee).
Already-claimed columns are excluded from subsequent passes.
3. exceljs hyperlink cells not unwrapped
Project Name cells in the Dow tracker are a mix of plain strings
(for rows Dow edited manually) and exceljs hyperlink objects
(rows auto-linked to the OMG brief — shape `{ text, hyperlink }`).
The old extractColumns only unwrapped richText and formula.result;
hyperlink objects fell through and Zod rejected them with
"projectName: Invalid input". 24 of 27 rows from the real XLSX
failed with this before; now 26/27 pass (the 1 remaining error is
a genuinely missing omgNumber, correctly flagged).
→ Extracted unwrapCell() that handles hyperlink, richText, formula,
error, and Date cells.
4. DEV_BYPASS_AUTH defaulted to "true" in .env.example
Anyone copying .env.example verbatim got a mock session pointing at
the HP-era "dev-user-001" which doesn't exist in the Dow DB,
causing mysterious P2025 errors on user.update. Also leaves the app
wide open — nobody's auth is actually checked.
→ Default to "false" in .env.example with a DANGEROUS warning.
5. layout.tsx metadata description still said "HP CG department"
→ Fixed to "the Dow Jones studio".
Verified end-to-end on a fresh local DB:
- Login as seeded admin ✓
- Forced password change on first login ✓
- XLSX import: 27 rows → 26 created, 1 error (missing omg number) ✓
- 267 deliverables across 5 client teams ✓
- Invited a CLIENT_VIEWER, assigned to Brand team only ✓
- Brand tester sees 1 project; admin sees 18 ✓
- Brand tester gets 403 on POST /api/projects ✓
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
2.5 KiB
Text
48 lines
2.5 KiB
Text
# ─── Database ────────────────────────────────────────────
|
|
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/dow_prod_tracker?schema=public"
|
|
DB_PASSWORD=postgres # Change in production
|
|
|
|
# ─── Auth (Microsoft Entra ID SSO — SPA registration) ───
|
|
AUTH_SECRET="" # Generate with: openssl rand -base64 32
|
|
# Azure AD Application (Client) ID
|
|
AZURE_CLIENT_ID=""
|
|
# Azure AD Directory (Tenant) ID
|
|
AZURE_TENANT_ID=""
|
|
# Redirect URI registered in Azure portal (SPA platform) — must be the login page URL
|
|
# e.g. https://your-domain.com/your-app/login
|
|
AZURE_REDIRECT_URI=""
|
|
# No client secret — SPA registrations use PKCE in the browser (no AUTH_URL needed)
|
|
|
|
# ─── Dev Auth Bypass (local development only) ───────────
|
|
# Set to "true" to skip all auth and auto-login as the DEV_USER_ID user.
|
|
# DANGEROUS — leaves the app wide open. Ignored in production.
|
|
# Default is "false" so the real local-auth flow is exercised on first
|
|
# run (log in as the seed admin — see DEPLOY.md / seed-dow.ts).
|
|
DEV_BYPASS_AUTH="false"
|
|
DEV_USER_ID="dev-user-001"
|
|
|
|
# ─── App ─────────────────────────────────────────────────
|
|
NEXT_PUBLIC_APP_URL="http://localhost:3000"
|
|
|
|
# ─── Claude AI (chat assistant — primary provider) ──────
|
|
ANTHROPIC_API_KEY=""
|
|
# ANTHROPIC_MODEL="claude-haiku-4-5-20251001"
|
|
|
|
# ─── Cron / Scheduler ───────────────────────────────────
|
|
CRON_SECRET="" # Generate with: openssl rand -hex 32
|
|
|
|
# ─── Ollama (AI — embeddings, search, chat fallback) ────
|
|
OLLAMA_HOST="http://localhost:11434"
|
|
OLLAMA_EMBED_MODEL="nomic-embed-text"
|
|
OLLAMA_LLM_MODEL="qwen3:1.7b"
|
|
|
|
# ─── OMG Webhook (Shashank pending — stub until payload confirmed) ──
|
|
# Shared HMAC secret OMG signs requests with (X-OMG-Signature: sha256=...)
|
|
OMG_WEBHOOK_SECRET=""
|
|
# Set to "true" ONLY for local/stub testing — skips signature verification
|
|
OMG_WEBHOOK_ALLOW_INSECURE="false"
|
|
|
|
# ─── Auth Feature Flags ─────────────────────────────────
|
|
# MVP: false. Flip to "true" post-MVP once Entra redirect URI is live in Oliver's tenant.
|
|
# When false, login page shows only the local email+password form.
|
|
NEXT_PUBLIC_AUTH_ENTRA_ENABLED="false"
|