From e474d037d30163a8ff211effd27838247b770a42 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Sun, 5 Jul 2026 22:49:00 +0800
Subject: [PATCH] fix: allow anonymous setup-status on production for mobile
 access

---
 src/app/api/setup-status/route.ts | 25 ++++-------------------
 tests/setup-status-route.test.ts  | 34 +++++++++++++++++++++++--------
 2 files changed, 29 insertions(+), 30 deletions(-)

diff --git a/src/app/api/setup-status/route.ts b/src/app/api/setup-status/route.ts
index bf0551c94..ba34855b8 100644
--- a/src/app/api/setup-status/route.ts
+++ b/src/app/api/setup-status/route.ts
@@ -2,7 +2,6 @@ import { NextResponse } from "next/server";
 import { env, isDemoMode } from "@/lib/env";
 import { localProjectRequestIdentityPayload, unsafeLocalProjectResponse } from "@/lib/local-project-guard";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
 import { formatSupabaseUnavailableError, isSupabaseUnavailableError, probeSupabaseHealth } from "@/lib/supabase/health";
 import { checkSupabaseProjectConfig, formatSupabaseProjectCheck } from "@/lib/supabase/project";
 
@@ -409,27 +408,11 @@ async function readSetupStatusPayload() {
   }
 }
 
-async function requireProductionSetupStatusAuth(request: Request) {
+export async function GET(request: Request) {
   const identity = localProjectRequestIdentityPayload(request);
-  if (process.env.NODE_ENV !== "production" || identity.localServer.currentUrl) {
-    return identity;
+  if (!identity.localServer.safeLocalOrigin) {
+    return unsafeLocalProjectResponse(identity);
   }
-  await requireAuthenticatedUser(request, createAdminClient());
-  return identity;
-}
 
-export async function GET(request: Request) {
-  try {
-    const identity = await requireProductionSetupStatusAuth(request);
-    if (!identity.localServer.safeLocalOrigin) {
-      return unsafeLocalProjectResponse(identity);
-    }
-
-    return setupStatusResponse(await readSetupStatusPayload());
-  } catch (error) {
-    if (error instanceof AuthenticationError) {
-      return unauthorizedResponse(error);
-    }
-    throw error;
-  }
+  return setupStatusResponse(await readSetupStatusPayload());
 }
diff --git a/tests/setup-status-route.test.ts b/tests/setup-status-route.test.ts
index 170aac7f5..f952b2ef8 100644
--- a/tests/setup-status-route.test.ts
+++ b/tests/setup-status-route.test.ts
@@ -7,10 +7,13 @@ afterEach(() => {
 });
 
 describe("/api/setup-status", () => {
-  it("requires auth for non-local production requests before returning setup posture", async () => {
+  it("returns setup posture for anonymous production requests without exposing secret values", async () => {
     vi.stubEnv("NODE_ENV", "production");
-    const getUser = vi.fn();
-    const createAdminClient = vi.fn(() => ({ auth: { getUser } }));
+    const from = vi.fn(async () => ({ error: null, data: [], count: 0 }));
+    const createAdminClient = vi.fn(() => ({
+      from,
+      rpc: vi.fn(),
+    }));
     vi.doMock("@/lib/env", () => ({
       env: {
         NEXT_PUBLIC_SUPABASE_URL: "https://sjrfecxgysukkwxsowpy.supabase.co",
@@ -24,16 +27,29 @@ describe("/api/setup-status", () => {
       isLocalNoAuthMode: () => false,
     }));
     vi.doMock("@/lib/supabase/admin", () => ({ createAdminClient }));
+    vi.doMock("@/lib/supabase/health", () => ({
+      probeSupabaseHealth: vi.fn(async () => ({ ok: true })),
+      isSupabaseUnavailableError: () => false,
+      formatSupabaseUnavailableError: (error: unknown) => String(error),
+    }));
+    vi.doMock("@/lib/supabase/project", () => ({
+      checkSupabaseProjectConfig: () => ({ status: "ready", detail: "Clinical KB Database target is configured." }),
+      formatSupabaseProjectCheck: () => "Clinical KB Database target is configured.",
+    }));
     const { GET } = await import("../src/app/api/setup-status/route");
 
     const response = await GET(new Request("https://clinical.example/api/setup-status"));
     const body = await response.json();
 
-    expect(response.status).toBe(401);
-    expect(body).toEqual({ error: "Authentication required." });
-    expect(JSON.stringify(body)).not.toContain("OPENAI");
-    expect(JSON.stringify(body)).not.toContain("Supabase");
-    expect(createAdminClient).toHaveBeenCalledTimes(1);
-    expect(getUser).not.toHaveBeenCalled();
+    expect(response.status).toBe(200);
+    expect(body).toMatchObject({
+      demoMode: false,
+      checks: expect.arrayContaining([
+        expect.objectContaining({ id: "env" }),
+        expect.objectContaining({ id: "openai" }),
+      ]),
+    });
+    expect(JSON.stringify(body)).not.toContain("service-role-key");
+    expect(JSON.stringify(body)).not.toContain("openai-key");
   });
 });