feat: add admin dashboard and core API routes with Docker configuration

admin/src/middleware.ts

@@ -15,11 +15,13 @@ const PUBLIC_PREFIXES = [
 
 export async function middleware(request: NextRequest) {
   const { pathname, search } = request.nextUrl;
+  const isServerAction = request.headers.has('next-action');
 
-  // 1. Bypass static files and Next.js internal assets
+  // 1. Bypass static files and Next.js internal assets (only for GET/HEAD, never for Server Action POSTs)
   if (
-    pathname.startsWith('/_next') ||
-    pathname.includes('.') // any file with an extension (e.g. favicon.ico, images, robots.txt)
+    !isServerAction &&
+    (request.method === 'GET' || request.method === 'HEAD') &&
+    (pathname.startsWith('/_next') || pathname.includes('.'))
   ) {
     return NextResponse.next();
   }
@@ -32,21 +34,24 @@ export async function middleware(request: NextRequest) {
 
   // 3. If accessing /login
   if (isLoginPage) {
-    // If already logged in, redirect directly to dashboard
-    if (session) {
+    // If already logged in and not invoking a login server action, redirect directly to dashboard
+    if (session && !isServerAction) {
       return NextResponse.redirect(new URL('/dashboard', request.url));
     }
     return NextResponse.next();
   }
 
-  // 4. If accessing other public APIs (like cron or external integrations)
+  // 4. If accessing other public APIs (like cron or external integrations), disallow Server Action invocations
   const isPublicPrefix = PUBLIC_PREFIXES.some(prefix => pathname.startsWith(prefix));
-  if (isPublicPrefix) {
+  if (isPublicPrefix && !isServerAction) {
     return NextResponse.next();
   }
 
-  // 5. Protected route: redirect to /login if unauthenticated
+  // 5. Protected route: redirect to /login if unauthenticated (or 401 for Server Actions)
   if (!session) {
+    if (isServerAction) {
+      return NextResponse.json({ error: 'Non autorisé' }, { status: 401 });
+    }
     const loginUrl = new URL('/login', request.url);
     const returnUrl = pathname + (search || '');
     if (pathname !== '/' && pathname !== '') {
@@ -58,6 +63,9 @@ export async function middleware(request: NextRequest) {
   // 6. Check granular tab permission
   const tabKey = getTabForPathname(pathname);
   if (tabKey && !hasTabPermission(session.adminRole, session.permissions, tabKey)) {
+    if (isServerAction) {
+      return NextResponse.json({ error: 'Permission refusée' }, { status: 403 });
+    }
     // If user lacks permission for this tab, redirect back to /dashboard
     const dashboardUrl = new URL('/dashboard', request.url);
     dashboardUrl.searchParams.set('unauthorized', tabKey);