fix(server): block disabled modules on subdomain routes

Ensure disabled modules redirect to space root on subdomain routing,
and pre-load community doc before checking enabled modules list.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jeff Emmett 2026-03-21 23:17:11 -07:00
parent e56b4fe89c
commit 6f066f649a
1 changed files with 11 additions and 0 deletions

View File

@ -2053,6 +2053,7 @@ for (const mod of getAllModules()) {
if (!space || space === "api" || space.includes(".")) return next();
// Check enabled modules (skip for core rspace module)
await loadCommunity(space);
const doc = getDocumentData(space);
if (mod.id !== "rspace") {
if (doc?.meta?.enabledModules && !doc.meta.enabledModules.includes(mod.id)) {
@ -2730,6 +2731,16 @@ const server = Bun.serve<WSData>({
return app.fetch(new Request(rewrittenUrl, req));
}
// Block disabled modules before rewriting — redirect to space root
const firstModId = pathSegments[0].toLowerCase();
if (firstModId !== "rspace") {
await loadCommunity(subdomain);
const spaceDoc = getDocumentData(subdomain);
if (spaceDoc?.meta?.enabledModules && !spaceDoc.meta.enabledModules.includes(firstModId)) {
return Response.redirect(`https://${subdomain}.rspace.online/`, 302);
}
}
// Normalize module ID to lowercase (rTrips → rtrips)
const normalizedPath = "/" + pathSegments.map((seg, i) =>
i === 0 ? seg.toLowerCase() : seg