diff --git a/furniture-3d-system/src/server/core/response.test.ts b/furniture-3d-system/src/server/core/response.test.ts
index 57efdf6b..d3fa189f 100644
--- a/furniture-3d-system/src/server/core/response.test.ts
+++ b/furniture-3d-system/src/server/core/response.test.ts
@@ -7,7 +7,19 @@ jest.mock('@/lib/storage', () => ({
     mockResolveObjectStorageUrlForClientAccess(...args),
 }))
 
-import { success, successWithPagination } from './response'
+import type { NextRequest } from 'next/server'
+import {
+  isSupplierAllowedApiRequest,
+  success,
+  successWithPagination,
+} from './response'
+
+function createRequest(path: string, method: string): NextRequest {
+  return {
+    method,
+    nextUrl: new URL(`http://localhost${path}`),
+  } as NextRequest
+}
 
 describe('response storage url normalization', () => {
   beforeEach(() => {
@@ -111,3 +123,20 @@ describe('response storage url normalization', () => {
     })
   })
 })
+
+describe('supplier request boundary', () => {
+  it.each([
+    ['GET', '/api/auth/me', true],
+    ['GET', '/api/intake/barcode-print', true],
+    ['POST', '/api/intake/barcode-print', true],
+    ['DELETE', '/api/intake/barcode-print', true],
+    ['GET', '/api/intake/node-permission-settings', false],
+    ['GET', '/api/intake/non-integrated', false],
+    ['GET', '/api/intake/non-integrated/product-1', false],
+    ['GET', '/api/intake/non-integrated/product-1/order-sheet', false],
+    ['GET', '/api/intake/non-integrated/product-1/contracts', false],
+    ['POST', '/api/users', false],
+  ])('supplier %s %s is allowed: %s', (method, path, expected) => {
+    expect(isSupplierAllowedApiRequest(createRequest(path, method))).toBe(expected)
+  })
+})
diff --git a/furniture-3d-system/src/server/core/response.ts b/furniture-3d-system/src/server/core/response.ts
index dacd114b..7ea19855 100644
--- a/furniture-3d-system/src/server/core/response.ts
+++ b/furniture-3d-system/src/server/core/response.ts
@@ -201,7 +201,7 @@ interface HandleRequestOptions {
   requireDesignWorkspaceWrite?: boolean
 }
 
-function isSupplierAllowedApiRequest(request: NextRequest) {
+export function isSupplierAllowedApiRequest(request: NextRequest) {
   const { pathname } = request.nextUrl
   const method = request.method.toUpperCase()
 
@@ -209,13 +209,6 @@ function isSupplierAllowedApiRequest(request: NextRequest) {
   if (pathname === '/api/intake/barcode-print') {
     return method === 'GET' || method === 'POST' || method === 'DELETE'
   }
-  if (method !== 'GET') return false
-  if (pathname === '/api/intake/node-permission-settings') return true
-  if (pathname === '/api/intake/non-integrated') return true
-  if (/^\/api\/intake\/non-integrated\/[^/]+$/.test(pathname)) return true
-  if (/^\/api\/intake\/non-integrated\/[^/]+\/order-sheet$/.test(pathname)) return true
-  if (/^\/api\/intake\/non-integrated\/[^/]+\/contracts$/.test(pathname)) return true
-
   return false
 }