fix(web): bypass auth proxy for local dev

[GautamSharma99]

Description
This removes a manual setup step for OSS contributors by making the web middleware
automatically allow plain localhost development.

Previously, CONTRIBUTING.md instructed contributors to manually edit the web proxy/middleware
before running bun run dev:local. Without that edit, local requests could be redirected
through the auth proxy instead of reaching the local app directly.

Changes

• Add a local-dev host bypass in apps/web/middleware.ts

  • localhost
  • 127.0.0.1
  • ::1

• Run the bypass before reading Better Auth session cookies

• Remove the obsolete manual proxy-edit step from CONTRIBUTING.md

Why
bun run dev:local should work without contributors modifying tracked source files. This keeps
local setup simpler and avoids accidental dirty worktrees.

Testing

• bunx biome check CONTRIBUTING.md apps/web/middleware.ts

---

Session Details

• Session: View Session
• Requested by: Unknown
• Address comments on this PR. Add (aside) to your comment to have me ignore it.

[vorflux]

Summary

Reviewed — found 1 issue(s). This PR moves the local development auth-proxy bypass from contributor instructions into apps/web/middleware.ts; the review focused on whether that bypass is safe and correctly scoped. The current implementation can be triggered from forwarded host data before any session or API auth checks run.

Findings

apps/web/middleware.ts

1. The local-dev bypass trusts the public request hostname and can skip authentication for production requests with a spoofed forwarded host.

Verdict

⚠️ Changes requested. The bypass needs to be constrained to true local development or based on an internal host signal before this is safe to merge.

---

Review with Vorflux

[vorflux]

getPublicRequestUrl(request) can derive url.hostname from forwarded host headers, so a production request with X-Forwarded-Host: localhost or 127.0.0.1 can enter this branch and skip the session checks, including the /api/* 401 guard. Please gate this bypass to a non-production/local-dev environment and/or check the actual internal request host instead of the forwarded public URL.

[vorflux]

Testing

The testing subagent validated the middleware behavior locally against origin/main and origin/pr-1213. The PR bypasses auth for localhost and 127.0.0.1, preserves auth behavior for non-local/public hosts, and found one remaining behavior issue: IPv6 loopback [::1] still redirects to login instead of bypassing auth.

Commands run:

cd /code/supermemoryai/supermemory/apps/web
export PATH="$HOME/.bun/bin:$PATH" && PORT=3000 bun run dev:app --hostname 0.0.0.0
curl -sS -o /tmp/body -D /tmp/headers -w 'status=%{http_code} redirect=%{redirect_url}\n' 'http://localhost:3000/'
curl -sS -o /tmp/body -D /tmp/headers -w 'status=%{http_code} redirect=%{redirect_url}\n' 'http://127.0.0.1:3000/'
curl -sS -o /tmp/body -D /tmp/headers -w 'status=%{http_code} redirect=%{redirect_url} type=%{content_type}\n' 'http://localhost:3000/api/nonexistent'
curl -sS -o /tmp/body -D /tmp/headers -w 'status=%{http_code} redirect=%{redirect_url} type=%{content_type}\n' 'http://127.0.0.1:3000/api/nonexistent'
curl -sS -H 'Host: app.supermemory.ai' -H 'X-Forwarded-Host: app.supermemory.ai' -H 'X-Forwarded-Proto: https' -o /tmp/body -D /tmp/headers -w 'status=%{http_code} redirect=%{redirect_url}\n' 'http://127.0.0.1:3000/'
cd /code/supermemoryai/supermemory/apps/web
export PATH="$HOME/.bun/bin:$PATH" && PORT=3000 bun run dev:app --hostname ::1
curl -g -sS --max-time 15 -o /var/tmp/pr1213-testing/pr-ipv6-actual-root.body -D /var/tmp/pr1213-testing/pr-ipv6-actual-root.headers -w 'status=%{http_code} redirect=%{redirect_url}\n' 'http://[::1]:3000/'
export PATH="$HOME/.bun/bin:$PATH" && bunx biome ci apps/web/middleware.ts CONTRIBUTING.md
cd apps/web && bunx tsc --noEmit

Result:

localhost /: status=200 redirect=
127.0.0.1 /: status=200 redirect=
localhost /api/nonexistent: status=404 redirect= type=text/html; charset=utf-8
127.0.0.1 /api/nonexistent: status=404 redirect= type=text/html; charset=utf-8
production forwarded host /: status=307 redirect=https://app.supermemory.ai/login?redirect=https%3A%2F%2Fapp.supermemory.ai%2F
IPv6 [::1] /: status=307 redirect=http://[::1]:3000/login?redirect=http%3A%2F%2F%5B%3A%3A1%5D%3A3000%2F
biome ci changed files: Checked 1 file in 131ms. No fixes applied.
tsc --noEmit: failed in unrelated/pre-existing files; no errors referenced apps/web/middleware.ts.

Evidence artifacts:

Verdict

⚠️ Issues found. Localhost and IPv4 loopback behavior worked, but IPv6 loopback [::1] still redirects to login, so the localhost bypass matrix is incomplete.

---

Attached Images and Videos

🎥 View recording: pr1213-localhost-127-route-level-404-bypass.webm

🎥 View recording: pr1213-ipv6-loopback-failure.webm

[Dhravya]

Pushed two commits (maintainer edits): a merge with main, and a guard change — the localhost bypass now also requires process.env.NODE_ENV === "development".

Reason: getPublicRequestUrl trusts the x-forwarded-host header, and this middleware 401-gates /api/*. Without the env guard, a production request with x-forwarded-host: localhost would skip that gate. NODE_ENV is inlined at build time, so the bypass is dead code in production bundles while still removing the manual proxy-edit step for local contributors.