DO NOT MERGE ,Modify response of not allowed pages,logo and image ko … by mr-raj12 · Pull Request #62 · bitotsav-fest/website

mr-raj12 · 2025-03-20T00:55:31Z

do not merge post testing merge not before 3:30

…/dashboard and /login p daal do rest all working

netlify · 2025-03-20T00:55:34Z

❌ Deploy Preview for bitotsav2 failed. Why did it fail? →

Name	Link
🔨 Latest commit	`5e25234`
🔍 Latest deploy log	https://app.netlify.com/sites/bitotsav2/deploys/67db6785eeafdc0008f56eff

vercel · 2025-03-20T00:55:35Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
bitotsav	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Mar 20, 2025 0:56am

Copilot

Pull request overview

This PR modifies the Next.js middleware to implement a restrictive route whitelist that only allows access to five specific routes (/login, /dashboard, /scanner, /logout, and /dashboard/non-bit) while blocking all others with a 404 response. The PR also adds early returns for static assets and API routes, updates the root path to redirect to login, and simplifies the matcher configuration.

Changes:

Implemented a hardcoded route whitelist that returns 404 for any route not explicitly allowed
Added redirect from root ("/") to "/login"
Introduced early returns for static file paths before authentication checks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-23T21:52:55Z

src/middleware.js

+
+  // Restrict routes
+  if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {
+    return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });


The error message text should not be embedded in the response body with a 404 status code. This creates a poor user experience as it returns a plain text message instead of rendering a proper 404 page. Consider either redirecting to a proper 404 error page or removing the whitelist approach entirely to allow Next.js to handle non-existent routes naturally with its built-in 404 handling.

Suggested change

return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });

return NextResponse.redirect(new URL("/404", req.url));

Copilot · 2026-02-23T21:52:56Z

src/middleware.js

-    '/((?!api|_next/static|_next/image|favicon.ico|public).*)',
-  ],
-}
+  matcher: ["/((?!_next/static|_next/image|favicon.ico|api).*)"], // Ignore static files and API routes


The matcher pattern excludes "_next/image" but the middleware checks for "/_next/" (line 9), which would include Next.js image optimization requests if they weren't already excluded by the matcher. Similarly, the pattern excludes "api" but checks for "/api/" with leading slash. This inconsistency between matcher patterns and runtime checks makes the code harder to understand and maintain.

Suggested change

matcher: ["/((?!_next/static|_next/image|favicon.ico|api).*)"], // Ignore static files and API routes

matcher: ["/((?!_next/|static/|api/|favicon\\.ico).*)"], // Ignore static files and API routes

Copilot · 2026-02-23T21:52:56Z

src/middleware.js

+});

-// Protect all routes except public ones
+// Updated matcher to exclude static assets and API routes


The original matcher comment provided more context about what was being excluded and why. The new comment is less informative. While this is a minor issue, more descriptive comments help future maintainers understand the intent. Consider expanding the comment to explain why static assets and API routes are excluded from middleware processing.

Copilot · 2026-02-23T21:52:56Z

src/middleware.js

+  // Restrict routes
+  if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {
+    return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });
+  }
+


The hardcoded route whitelist approach creates a maintenance burden and is fragile. Every time a new route is added to the application, the middleware must be updated manually. This is error-prone and doesn't scale well. Consider using a more maintainable approach such as: (1) defining protected routes instead of allowed routes, (2) using route metadata or conventions to determine which routes require authentication, or (3) removing the whitelist entirely and relying on Next.js's natural 404 behavior for non-existent routes while only adding authentication checks for routes that need protection.

Suggested change

// Restrict routes

if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {

return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });

}

Copilot · 2026-02-23T21:52:56Z

src/middleware.js

+  // Restrict routes
+  if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {
+    return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });
+  }
+


The route whitelist severely restricts access to most of the application's pages. The whitelist only allows access to /login, /dashboard, /scanner, /logout, and /dashboard/non-bit, but the application has many public routes that should remain accessible including: /events, /tickets, /team, /developers, /sponsors, /about, /merch, /gallery, /alumni, /signature, /virtual-helpdesk, /adminpanel, /concerts, /coming-soon, /leaderboard, /notice, /privacy, /terms, and event detail pages at /events/[id]. All these routes will return a 404 error with this change, breaking the majority of the application's functionality.

Suggested change

// Restrict routes

if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {

return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });

}

Copilot · 2026-02-23T21:52:57Z

src/middleware.js

+  if (pathname.startsWith("/_next/") || pathname.startsWith("/api/") || pathname.startsWith("/static/")) {
+    return NextResponse.next();
+  }
+
+  // Redirect root ("/") to "/login"
+  if (pathname === "/") {
+    return NextResponse.redirect(new URL("/login", req.url));
+  }
+
+  // Restrict routes
+  if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {
+    return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });
+  }


The matcher configuration does not exclude the public folder, and Next.js serves static files from the public directory at the root path (e.g., /logo.png maps to public/logo.png). With the current whitelist implementation, all public assets like /logo.png, /bitotsav-logo.svg, /manifest.json, and image files will be blocked and return a 404 error. The matcher should exclude public assets, or the whitelist should not be applied to direct file requests. Consider adding a check for file extensions (e.g., .png, .svg, .jpg, .json) or removing the restrictive whitelist approach.

Copilot · 2026-02-23T21:52:57Z

src/middleware.js

+  // Allow all static files and API requests
+  if (pathname.startsWith("/_next/") || pathname.startsWith("/api/") || pathname.startsWith("/static/")) {
+    return NextResponse.next();
+  }
+
+  // Redirect root ("/") to "/login"
+  if (pathname === "/") {
+    return NextResponse.redirect(new URL("/login", req.url));
+  }
+
+  // Restrict routes
+  if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {
+    return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });
+  }


The PR title mentions modifying responses for "not allowed pages, logo and image" but the implementation blocks access to valid application routes rather than just handling static assets. The title suggests this change is about fixing logo and image handling, but the actual implementation introduces a restrictive whitelist that breaks most of the application. This discrepancy between the PR description and implementation makes it unclear what the intended goal is. Clarification is needed on whether the goal is to (1) fix static asset handling, or (2) intentionally restrict the application to only a few routes for testing purposes.

Copilot · 2026-02-23T21:52:57Z

src/middleware.js

+  // Allow all static files and API requests
+  if (pathname.startsWith("/_next/") || pathname.startsWith("/api/") || pathname.startsWith("/static/")) {
+    return NextResponse.next();
+  }


The static file handling logic at lines 9-11 is redundant because the matcher configuration at line 37 already excludes these paths from middleware execution. The checks for paths starting with "/_next/", "/api/", and "/static/" will never be reached since the matcher pattern excludes "_next/static", "_next/image", "favicon.ico", and "api". This redundant code should be removed to avoid confusion.

Copilot · 2026-02-23T21:52:57Z

src/middleware.js

+  if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {
+    return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });
+  }
+
+  // Redirect users based on authentication
+  if (!isAuthenticated && ["/dashboard", "/dashboard/non-bit"].includes(pathname)) {


The /dashboard/day-scholar and /dashboard/bit routes exist in the application but are not included in the whitelist. These routes will return a 404 error even though they are valid application routes. Only /dashboard and /dashboard/non-bit are whitelisted, creating an inconsistency in dashboard sub-route access.

Suggested change

if (!["/login", "/dashboard", "/scanner", "/logout", "/dashboard/non-bit"].includes(pathname)) {

return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });

}

// Redirect users based on authentication

if (!isAuthenticated && ["/dashboard", "/dashboard/non-bit"].includes(pathname)) {

if (

![

"/login",

"/dashboard",

"/scanner",

"/logout",

"/dashboard/non-bit",

"/dashboard/day-scholar",

"/dashboard/bit",

].includes(pathname)

) {

return new NextResponse(

"Only /login, /dashboard, /scanner, /logout, /dashboard/non-bit, /dashboard/day-scholar, and /dashboard/bit will work",

{ status: 404 },

);

}

// Redirect users based on authentication

if (

!isAuthenticated &&

["/dashboard", "/dashboard/non-bit", "/dashboard/day-scholar", "/dashboard/bit"].includes(pathname)

) {

Copilot · 2026-02-23T21:52:58Z

src/middleware.js

+  }
+
+  // Redirect users based on authentication
+  if (!isAuthenticated && ["/dashboard", "/dashboard/non-bit"].includes(pathname)) {


The /scanner route is included in the whitelist but has no authentication check in the middleware. However, the scanner page implements its own passcode-based authentication (hardcoded passcode: '192020'). This creates an inconsistency where authenticated users are not redirected from /login but /scanner has no middleware-level authentication check. Consider whether /scanner should require authentication at the middleware level or if it should remain accessible to all users with its own internal authentication mechanism.

Suggested change

if (!isAuthenticated && ["/dashboard", "/dashboard/non-bit"].includes(pathname)) {

if (!isAuthenticated && ["/dashboard", "/dashboard/non-bit", "/scanner"].includes(pathname)) {

DO NOT MERGE ,Modify response of not allowed pages,logo and image ko …

5e25234

…/dashboard and /login p daal do rest all working

vercel bot deployed to Preview March 20, 2025 00:56 View deployment

SH20RAJ requested a review from Copilot February 23, 2026 21:47

Copilot started reviewing on behalf of SH20RAJ February 23, 2026 21:48 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

	return new NextResponse("Only /login, /dashboard, /scanner, /logout, and /dashboard/non-bit will work", { status: 404 });
	return NextResponse.redirect(new URL("/404", req.url));

	matcher: ["/((?!_next/static\|_next/image\|favicon.ico\|api).*)"], // Ignore static files and API routes
	matcher: ["/((?!_next/\|static/\|api/\|favicon\\.ico).*)"], // Ignore static files and API routes

	if (!isAuthenticated && ["/dashboard", "/dashboard/non-bit"].includes(pathname)) {
	if (!isAuthenticated && ["/dashboard", "/dashboard/non-bit", "/scanner"].includes(pathname)) {

Conversation

mr-raj12 commented Mar 20, 2025

Uh oh!

netlify bot commented Mar 20, 2025

❌ Deploy Preview for bitotsav2 failed. Why did it fail? →

Uh oh!

vercel bot commented Mar 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel bot commented Mar 20, 2025 •

edited

Loading