fix(auth): remove middleware self-fetch and SSL loop

validation-suite/frontend/atlas/tests/middleware-ssl.test.mjs

@@ -0,0 +1,36 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import test from "node:test";
+
+const middlewarePath = path.resolve("middleware.ts");
+const appShellPath = path.resolve("components/app-shell.tsx");
+const middlewareSource = fs.readFileSync(middlewarePath, "utf8");
+const appShellSource = fs.readFileSync(appShellPath, "utf8");
+
+test("middleware does not perform fetches or self-fetch /api/me", () => {
+  assert.doesNotMatch(middlewareSource, /fetch\s*\(/);
+  assert.doesNotMatch(middlewareSource, /new URL\(\s*["']\/api\/me["']/);
+  assert.doesNotMatch(middlewareSource, /request\.nextUrl\.origin/);
+  assert.doesNotMatch(middlewareSource, /https:\/\/[^"']*8000/);
+});
+
+test("middleware redirects protected routes without cookie to login", () => {
+  assert.match(middlewareSource, /const token = request\.cookies\.get\(AUTH_COOKIE_NAME\)\?\.value/);
+  assert.match(middlewareSource, /if \(!token\)/);
+  assert.match(middlewareSource, /if \(isProtected\)/);
+  assert.match(middlewareSource, /NextResponse\.redirect\(new URL\(["']\/login["'], request\.url\)\)/);
+});
+
+test("middleware allows protected routes with cookie and redirects login to dashboard", () => {
+  assert.match(middlewareSource, /const isLogin = request\.nextUrl\.pathname === ["']\/login["']/);
+  assert.match(middlewareSource, /NextResponse\.redirect\(new URL\(["']\/dashboard["'], request\.url\)\)/);
+  assert.match(middlewareSource, /return NextResponse\.next\(\)/);
+  assert.match(middlewareSource, /["']\/profile["']/);
+});
+
+test("must_change_password is handled outside middleware", () => {
+  assert.doesNotMatch(middlewareSource, /must_change_password/);
+  assert.match(appShellSource, /auth\.user\?\.must_change_password/);
+  assert.match(appShellSource, /window\.location\.replace\(["']\/profile\/security["']\)/);
+});