feat/atlas-scan
needs attentionviewing older commit9f8b61a · incrementalpre-PRreviewed 2026-08-03 19:15 UTC0H · 2M · 3L · 4I- Purpose
- Private atlas (Power Finder siting suite with proprietary layers) served exclusively to authenticated platform sessions from atlas-private/ (outside public/)
- Goal
- Two-layer auth guard for the atlas: middleware proxy redirects anonymous → login, route handler validates JWT and serves files with no-store caching
- Sub-goals
- SG-1: Auth layer — proxy gate + handler gate, both must agree
- SG-2: Static file server — path traversal guard, extension allowlist, no-store/noindex headers
- SG-3: Relative URL fix — inject <base href> so atlas fetch('data/…') routes to /atlas/data/…
- SG-4: Anti-cycle fix — handler fails closed (401) instead of redirecting, preventing login↔atlas loops
- What
- Handler auth failure changed from 307 redirect to login → flat 401 fail-closed. index.html served with injected <base href="/atlas/"> to anchor relative asset fetches. _req unused param rename. Test assertions updated to match.
- Why
- The redirect in the handler + redirect in the proxy created a potential infinite loop across deploy windows where the two layers disagree. A bare 401 cannot cycle. The base href fixes broken relative fetches when the atlas page lives at /atlas (no trailing slash — Vercel normalizes /atlas/ → /atlas with 308).
- Areas
- apps/platform/src/app/atlas/[[...path]]+15−6apps/platform/src/lib/supabase/__tests__+10−7scripts/atlas/pland+5200−12apps/platform/atlas-private/data+3100−0scripts/atlas/congestion+2800−0apps/web/public+1900−15
- Blast
- 113 files, +13,759/-59 across the branch. This commit: 2 files, +25/-13 — surgical fix to auth handler + tests.
Findings · 10
correctness2
base href injection: case-sensitive, non-global replace silently fails on <HEAD> or <head …>
apps/platform/src/app/atlas/[[...path]]/route.ts:63
String.replace('<head>', ...) matches only the first occurrence and is case-sensitive. If the atlas build ever emits '<HEAD>' or '<head lang="…">', the injection silently no-ops — relative fetches break in production with no observable error at deploy time. Fix: use .replace(/<head>/i, ...) with a guard against double-injection.
401 leaves users at a dead end if the proxy layer misses — no path back to login
apps/platform/src/app/atlas/[[...path]]/route.ts:42
The anti-cycle rationale is sound and documented. However, if middleware ever stops running on this route, users navigating directly get a plain 'Session required' text page with no link to login. The comment acknowledges this trade-off; flagging as low-severity for awareness.
security3
<base href> changes origin of ALL relative URLs in atlas HTML
apps/platform/src/app/atlas/[[...path]]/route.ts:63
Injecting <base href="/atlas/"> reroutes every relative fetch, form action, and anchor through /atlas/ on the platform origin. Intended for data/ assets, but verify the atlas bundle has no unintended relative external references that should resolve elsewhere.
Auth fail-closed 401 is strictly better than the previous redirect
apps/platform/src/app/atlas/[[...path]]/route.ts
Previous redirect to /login with req.url had minor open-redirect surface. The new flat 401 removes all URL construction from request data, eliminates the redirect cycle risk across deploy windows, and gives API/fetch clients a machine-readable signal.
HTML mutation safe — buf is fs-sourced, injected string is hardcoded
apps/platform/src/app/atlas/[[...path]]/route.ts
No XSS vector: buf comes from server-side readFile on a path already confined to BASE via traversal guard + extension allowlist. The injected value is a hardcoded literal with no user-controlled data.
conventions2
Spanish inline comments in otherwise English-convention code files
apps/platform/src/app/atlas/[[...path]]/route.ts
The new comments are in Spanish ('La página vive en /atlas', 'El <base> los ancla a /atlas/') while the codebase defaults to English for code comments. Same applies to the added test comment. The WHY rationale is good; the language is the only nit.
Test body comment duplicates the test name rationale
apps/platform/src/lib/supabase/__tests__/atlas-route-gate.test.ts:73
The inline comment 'El redirect a login es trabajo del proxy...' repeats the anti-cycle rationale already encoded in the test name. The test name is the right place for 'why'.
improvement3
base href injection non-idempotent — no guard against pre-existing <base> tag
apps/platform/src/app/atlas/[[...path]]/route.ts:63
If the atlas artifact already contains a <base> tag from its build tool, a second one is prepended. Browsers use the first <base>, so the injected one wins, but behavior is surprising and breakable. Check !buf.toString().includes('<base ') before patching, or use a case-insensitive regex.
UTF-8 round-trip allocates two intermediate buffers per index.html request
apps/platform/src/app/atlas/[[...path]]/route.ts:63
buf.toString → string mutate → Buffer.from → Uint8Array is three allocations. Minor for a low-traffic internal route, but Buffer.from(patched, 'utf8') followed by passing that directly to new Uint8Array(...) saves one allocation.
401 response body missing Content-Type and WWW-Authenticate header
apps/platform/src/app/atlas/[[...path]]/route.ts:45
RFC 9110 recommends a WWW-Authenticate header on 401 responses. Not blocking — this is a browser-facing route, not an API — but adding Content-Type: text/plain and WWW-Authenticate: Bearer realm="platform" would aid debugging.
History · 16 commits
- 91aaedfsafeincremental0H · 1M · 1L2026-08-12 17:35
- cb8d915needs attentionincremental2H · 5M · 3L2026-08-12 17:29
- 4cbbe8aneeds attentionincremental0H · 3M · 8L2026-08-12 14:01
- 4aa3c02needs attentionincremental2H · 3M · 3L2026-08-12 02:35
- f5630b2needs attentionincremental0H · 4M · 5L2026-08-12 02:17
- 28fde5bneeds attentionincremental1H · 2M · 2L2026-08-12 01:53
- 0babe51needs attentionincremental1H · 2M · 5L2026-08-12 01:23
- 50e8a8cneeds attentionincremental3H · 5M · 7L2026-08-11 23:58
- 3af4686needs attentionincremental3H · 5M · 5L2026-08-03 20:07
- f5d3266needs attentionincremental0H · 3M · 8L2026-08-03 19:40
- 9f8b61aneeds attentionincremental0H · 2M · 3L2026-08-03 19:15current
- ea51fa0needs attentionincremental1H · 4M · 4L2026-08-03 19:02
- 2b33f2fneeds attentionincremental0H · 1M · 1L2026-07-18 05:09
- 2f8cf79needs attentionincremental1H · 3M · 4L2026-07-18 00:59
- 1616332safeincremental0H · 0M · 1L2026-07-18 00:22
- e997fd8needs attentionfull1H · 4M · 6L2026-07-17 23:53