Feature/maintenance mode

[emrysal]

What does this PR do?

Implements a MaintenancePage that is used by our Vercel Edge Config to show a maintenance window by setting the following variable.

{"isInMaintenanceMode": true}

see: https://vercel.com/templates/next.js/maintenance-page

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated
cal	✅ Ready (Inspect)	Visit Preview	💬 Add your feedback	Feb 8, 2023 at 9:49PM (UTC)
ui	✅ Ready (Inspect)	Visit Preview	💬 Add your feedback	Feb 8, 2023 at 9:49PM (UTC)

[socket-security]

Socket Security Pull Request Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package	Script field	Source
@prisma/client@4.10.0 (upgraded)	postinstall	package.json via @next-auth/prisma-adapter@1.0.4, apps/web/package.json via @next-auth/prisma-adapter@1.0.4, packages/prisma/package.json
@prisma/engines@4.8.1 (added)	postinstall	package.json via @next-auth/prisma-adapter@1.0.4, @prisma/client@4.10.0, prisma@4.8.1, apps/web/package.json via @next-auth/prisma-adapter@1.0.4, packages/prisma/package.json via @prisma/client@4.10.0, prisma@4.8.1

Pull request report summary

Issue	Status
Install scripts	⚠️ 2 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2

• @SocketSecurity ignore @prisma/client@4.10.0
• @SocketSecurity ignore @prisma/engines@4.8.1

Powered by socket.dev

[emrysal]

Confirmed on the preview environment that this works, even though this is not active on the majority of routes, when a 500 error is detected on the app the user is automatically redirected to /auth/login which does have this enabled, the result is the desired behaviour.

[baileypumfleet]

Code looks good to me, haven't tested but will defer to zomars for final approval

[PeerRich]

interesting, tho i wanna make sure this only happens when actually something happens. i don't wanna show this to silent 500's and have false positives people thinking we're down

[emrysal]

@PeerRich Enabling the /maintenance redirect, although you can navigate to /maintenance manually, will only be true when we modify the edge config. The following ensures this will be loaded ONLY when we set this to true. Note that we must remember to also turn this back into false after we are done, but that's simple enough.

      // Check whether the maintenance page should be shown
      const isInMaintenanceMode = await get<boolean>("isInMaintenanceMode");
      // If is in maintenance mode, point the url pathname to the maintenance page
      if (isInMaintenanceMode) {
        req.nextUrl.pathname = `/maintenance`;
        return NextResponse.rewrite(req.nextUrl);
      }
      ```

[JeroenReumkens]

Be aware that this middleware doesn't run on all routes. It only runs if the path is matched in the config on line 70. That config was added not so long ago, because before that the middleware was indeed ran on all of the routes, which was quite costly as far as I remember.

[emrysal]

I tried earlier on to have it without that config, but that also meant this logic was ran on non html pages like _next - brought back that config.

The reason this works although effectively the only page is /auth/login is because the user is redirected to the login page on trpc error (I think it has an unauth handler that triggers on error).

[zomars]