log

innungsapp/apps/admin/Dockerfile

@@ -76,6 +76,9 @@ COPY --from=builder /app/apps/admin/.next/standalone ./
 COPY --from=builder /app/apps/admin/.next/static ./apps/admin/.next/static
 COPY --from=builder /app/apps/admin/public ./apps/admin/public
 
+# Fix permissions so nextjs user can write to .next/cache at runtime
+RUN chown -R nextjs:nodejs /app/apps/admin/.next
+
 # Copy Prisma schema + migrations for runtime migrations
 COPY --from=builder /app/packages/shared/prisma ./packages/shared/prisma
 

innungsapp/apps/admin/middleware.ts

@@ -97,7 +97,8 @@ export function middleware(request: NextRequest) {
       // We don't want to redirect /login, /api, etc.
       const SHARED_PATHS = ['login', 'api', 'superadmin', 'dashboard', 'registrierung', 'impressum', 'datenschutz', '_next', 'uploads', 'favicon.ico', 'passwort-aendern']
       const isStaticAsset = /\.(png|jpg|jpeg|gif|svg|webp|ico|txt|xml)$/i.test(potentialSlug)
-      if (potentialSlug && !SHARED_PATHS.includes(potentialSlug) && !isStaticAsset) {
+      const isValidSlug = /^[a-z0-9][a-z0-9-]*$/.test(potentialSlug)
+      if (potentialSlug && !SHARED_PATHS.includes(potentialSlug) && !isStaticAsset && isValidSlug) {
         // This looks like a tenant path being accessed from the root domain.
         // Redirect to subdomain.
         const baseHost = hostname.split('.').slice(-2).join('.') // Simplistic, assumes domain.tld or localhost