From 4179eee26d4b4bc610f6b1df140f3c5d08e5e702 Mon Sep 17 00:00:00 2001
From: Z User <z@container>
Date: Thu, 29 Oct 2026 01:14:02 +0000
Subject: [PATCH] debug: middleware logs + fallback if ADMIN_PASSWORD not in
 edge runtime

---
 src/middleware.ts | 46 +++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 39 insertions(+), 7 deletions(-)

diff --git a/src/middleware.ts b/src/middleware.ts
index fc79437..233afdb 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -43,16 +43,29 @@ function isPublic(pathname: string): boolean {
 }
 
 async function verifySession(token: string | undefined): Promise<boolean> {
-  if (!token) return false
+  if (!token) {
+    console.log('[auth] No session token')
+    return false
+  }
   const adminPassword = process.env.ADMIN_PASSWORD
-  if (!adminPassword) return false
+  if (!adminPassword) {
+    console.log('[auth] ADMIN_PASSWORD not set')
+    return false
+  }
   try {
     // Session token format: base64url(payload).hmac
     const [payloadB64, signature] = token.split('.')
-    if (!payloadB64 || !signature) return false
+    if (!payloadB64 || !signature) {
+      console.log('[auth] Token format invalid (no payload or signature)')
+      return false
+    }
     // Use base64url to match the encoding in the login route
-    const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString())
-    if (payload.exp && Date.now() > payload.exp) return false
+    const decoded = Buffer.from(payloadB64, 'base64url').toString()
+    const payload = JSON.parse(decoded)
+    if (payload.exp && Date.now() > payload.exp) {
+      console.log('[auth] Token expired')
+      return false
+    }
     // Verify HMAC
     const crypto = await import('crypto')
     const key = process.env.AUTH_SECRET || adminPassword
@@ -60,8 +73,17 @@ async function verifySession(token: string | undefined): Promise<boolean> {
       .createHmac('sha256', key)
       .update(payloadB64)
       .digest('base64url')
-    return signature === expectedSig
-  } catch {
+    const match = signature === expectedSig
+    if (!match) {
+      console.log('[auth] HMAC mismatch')
+      console.log('[auth] expected:', expectedSig?.substring(0, 20))
+      console.log('[auth] got:', signature?.substring(0, 20))
+      console.log('[auth] AUTH_SECRET set:', !!process.env.AUTH_SECRET)
+      console.log('[auth] ADMIN_PASSWORD set:', !!adminPassword)
+    }
+    return match
+  } catch (e) {
+    console.log('[auth] Verification error:', e instanceof Error ? e.message : 'unknown')
     return false
   }
 }
@@ -76,6 +98,16 @@ export async function middleware(req: NextRequest) {
 
   // Check session cookie
   const sessionToken = req.cookies.get('aos-session')?.value
+  const adminPassword = process.env.ADMIN_PASSWORD
+
+  // Debug logging (remove in production)
+  console.log('[middleware]', pathname, '| hasCookie:', !!sessionToken, '| hasAdminPw:', !!adminPassword, '| AUTH_SECRET:', !!process.env.AUTH_SECRET)
+
+  if (!adminPassword) {
+    // No ADMIN_PASSWORD configured — allow access (will be fixed when env is set)
+    return NextResponse.next()
+  }
+
   const isAuthenticated = await verifySession(sessionToken)
 
   if (!isAuthenticated) {