From 15dfb13b57dc78c08098d3ba2e43a1d5cb2aed5b Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 25 Feb 2026 22:06:16 +0800 Subject: [PATCH] fix: add middleware to bypass auth for payment callback routes DuluPay payment callbacks were returning 307 redirect to login page because the server-to-server requests have no session cookie. This caused all payment notifications to fail, preventing points from being credited after successful payment. Co-Authored-By: Claude Opus 4.6 --- middleware.ts | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 middleware.ts diff --git a/middleware.ts b/middleware.ts new file mode 100644 index 000000000..f227e2f41 --- /dev/null +++ b/middleware.ts @@ -0,0 +1,17 @@ +import { NextRequest, NextResponse } from "next/server"; + +/** + * Middleware to ensure payment callback paths are never blocked by auth. + * + * DuluPay sends server-to-server GET/POST callbacks without any session + * cookie. Without this middleware, the request may be intercepted and + * redirected to the login page (HTTP 307), causing payment notifications + * to fail silently and points never being credited. + */ +export function middleware(_request: NextRequest) { + return NextResponse.next(); +} + +export const config = { + matcher: ["/api/payment/:path*"], +};