From 77c9ac244baaa485ff6ffb65bfe69ac873ffa8c6 Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Wed, 25 Feb 2026 22:14:25 +0800
Subject: [PATCH] fix: allow DuluPay payment callbacks to bypass auth in
 proxy.ts

The previous commit incorrectly added middleware.ts which conflicts
with Next.js 16's proxy.ts. The actual auth gate is in proxy.ts which
redirects unauthenticated GET requests to /login. DuluPay's server-to-
server callbacks have no session cookie, so they need to be whitelisted.

Removes middleware.ts and adds /api/payment/* to proxy.ts whitelist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 middleware.ts | 17 -----------------
 proxy.ts      |  5 +++++
 2 files changed, 5 insertions(+), 17 deletions(-)
 delete mode 100644 middleware.ts

diff --git a/middleware.ts b/middleware.ts
deleted file mode 100644
index f227e2f41..000000000
--- a/middleware.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-
-/**
- * Middleware to ensure payment callback paths are never blocked by auth.
- *
- * DuluPay sends server-to-server GET/POST callbacks without any session
- * cookie.  Without this middleware, the request may be intercepted and
- * redirected to the login page (HTTP 307), causing payment notifications
- * to fail silently and points never being credited.
- */
-export function middleware(_request: NextRequest) {
-  return NextResponse.next();
-}
-
-export const config = {
-  matcher: ["/api/payment/:path*"],
-};
diff --git a/proxy.ts b/proxy.ts
index c4c9a0c58..8a58b3d2d 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -161,6 +161,11 @@ export async function proxy(request: NextRequest) {
     return NextResponse.next();
   }
 
+  // 允许 DuluPay 支付回调（服务端回调无 session cookie）
+  if (pathname.startsWith("/api/payment/")) {
+    return NextResponse.next();
+  }
+
   // 检测是否为 HTTPS（通过 AUTH_URL 或请求协议判断）
   const isSecure = process.env.AUTH_URL?.startsWith("https://") || 
                    request.nextUrl.protocol === "https:";