feat/atlas-scan

DataDownload contentUrl resolves to 404 on the marketing domain

apps/web/src/app/(marketing)/atlas/page.tsx:85

contentUrl uses SITE=batuenergy.com but the files are served from app.batuenergy.com behind auth. Every download URL is a broken link. Fix: use ATLAS_APP (already on line 12) or remove the distribution block.

isAccessibleForFree: true contradicts the auth gate

apps/web/src/app/(marketing)/atlas/page.tsx:73

The atlas requires a Batu platform login; the page's own UI says so. isAccessibleForFree:true misrepresents the resource to search engines. Set to false or omit.

SVG in TYPES allowlist enables inline script execution (persistent XSS vector)

apps/platform/src/app/atlas/[[...path]]/route.ts:33

image/svg+xml served at a same-origin URL allows embedded <script> execution. No SVGs exist today but the allowlist is open. Remove .svg from TYPES or force Content-Disposition: attachment.

Missing X-Content-Type-Options and X-Frame-Options on all responses

apps/platform/src/app/atlas/[[...path]]/route.ts:62

Route handlers don't inherit Next.js default security headers. Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to prevent MIME sniffing and clickjacking.

Handler comment misattributes proxy behavior

apps/platform/src/app/atlas/[[...path]]/route.ts:17

Says 'el proxy solo presence-checkea cookies' but the proxy also calls getClaims() for full JWT validation. Both layers are proper JWT gates. Update comment to reflect reality.

permanent:false redirect lacks comment explaining why permanent:true would be wrong

apps/platform/next.config.ts:27

This is a routing seam (i18n router adds locale, handler strips it), not a stable URL alias change. A 308 cached by the browser would bypass future proxy auth logic. Add a comment explaining this.

Non-existent allowed-extension file not tested (404 on fs error)

apps/platform/src/lib/supabase/__tests__/atlas-route-gate.test.ts:99

The fs.readFile error path returns 404, but no test exercises it. Add: call(['data','nonexistent.json']) → expect 404.

.geojson and .csv MIME types not asserted

apps/platform/src/lib/supabase/__tests__/atlas-route-gate.test.ts:99

Core private data layers use .geojson and .csv MIME types, which differ from the tested .json. A TYPES map typo would go undetected.

Tests read real atlas-private files — content-sensitive assertion

apps/platform/src/lib/supabase/__tests__/atlas-route-gate.test.ts:82

toContain('Power Finder') will break if index.html is rebuilt. Mock fs.promises.readFile or use a fixture file.

Proxy gate not tested for /atlas/data/... subpath

apps/platform/src/lib/supabase/__tests__/atlas-route-gate.test.ts:37

The realistic unauthenticated attack vector is a direct GET /atlas/data/pf.json. Add a proxy test for this path.

Nested subdirectory path not exercised

apps/platform/src/lib/supabase/__tests__/atlas-route-gate.test.ts:99

data/demand/today.json exercises the multi-level join+normalize+startsWith guard. Add one test for a nested subpath.

/atlas in PROTECTED_ROUTE_PATTERNS is dead code

apps/platform/src/lib/supabase/proxy.ts:12

The special-case block at line 182 intercepts all /atlas* requests before isProtectedRoute() is ever evaluated. Remove the /atlas entry from the array; keep the explanation in the special-case comment.

Handler login redirect is locale-free — extra proxy hop

apps/platform/src/app/atlas/[[...path]]/route.ts:46

Handler redirects to /login (no locale); proxy then adds /es/login. Use /${DEFAULT_LOCALE}/login to match proxy convention and avoid the extra round-trip.

Unnecessary Uint8Array copy for file buffer

apps/platform/src/app/atlas/[[...path]]/route.ts:63

Buffer extends Uint8Array. new Uint8Array(buf) copies the buffer. Pass buf directly to NextResponse to avoid the copy for large GeoJSON/CSV files.