From 634ba8d494e14f07bf404674ccd3f94800614dae Mon Sep 17 00:00:00 2001
From: Peter Meier <peter.meier.1986@gmail.com>
Date: Sun, 15 Mar 2026 22:05:14 +0100
Subject: [PATCH] Fix middleware matcher basePath issue, always show logout
 button

Next.js prepends basePath to matcher patterns, so patterns must not
include /admin prefix. Logout button now always visible in sidebar.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 admin-ui/src/components/Sidebar.tsx | 50 +++++++++--------------------
 admin-ui/src/middleware.ts          | 15 ++++-----
 2 files changed, 21 insertions(+), 44 deletions(-)

diff --git a/admin-ui/src/components/Sidebar.tsx b/admin-ui/src/components/Sidebar.tsx
index 2b7e5ef..27ef83d 100644
--- a/admin-ui/src/components/Sidebar.tsx
+++ b/admin-ui/src/components/Sidebar.tsx
@@ -226,41 +226,21 @@ export function Sidebar({ locale, mobileOpen = false, onClose }: SidebarProps) {
         </div>
       </nav>
       <div className="mt-2 border-t border-accent-200/50 pt-2">
-        {!mounted ? (
-          <Link
-            href="/login"
-            onClick={onClose}
-            className={`${navLinkClass} w-full text-left text-gray-700 no-underline hover:bg-accent-100/80 hover:text-gray-900 ${pathname === "/login" ? "bg-accent-200/70 font-medium text-gray-900" : ""}`}
-          >
-            <Icon icon="mdi:login" className="size-4" aria-hidden />
-            {t("login")}
-          </Link>
-        ) : hasStoredKey ? (
-          <button
-            type="button"
-            onClick={async () => {
-              clearSession();
-              setLogoutVersion((v) => v + 1);
-              onClose?.();
-              await fetch("/admin/api/auth/logout", { method: "POST" });
-              router.push("/login");
-              router.refresh();
-            }}
-            className={`${navLinkClass} w-full text-left text-gray-700 hover:bg-accent-100/80 hover:text-gray-900`}
-          >
-            <Icon icon="mdi:logout" className="size-4" aria-hidden />
-            {t("logout")}
-          </button>
-        ) : !hasEnvKey ? (
-          <Link
-            href="/login"
-            onClick={onClose}
-            className={`${navLinkClass} w-full text-left text-gray-700 no-underline hover:bg-accent-100/80 hover:text-gray-900 ${pathname === "/login" ? "bg-accent-200/70 font-medium text-gray-900" : ""}`}
-          >
-            <Icon icon="mdi:login" className="size-4" aria-hidden />
-            {t("login")}
-          </Link>
-        ) : null}
+        <button
+          type="button"
+          onClick={async () => {
+            clearSession();
+            setLogoutVersion((v) => v + 1);
+            onClose?.();
+            await fetch("/admin/api/auth/logout", { method: "POST" });
+            router.push("/login");
+            router.refresh();
+          }}
+          className={`${navLinkClass} w-full text-left text-gray-700 hover:bg-accent-100/80 hover:text-gray-900`}
+        >
+          <Icon icon="mdi:logout" className="size-4" aria-hidden />
+          {t("logout")}
+        </button>
       </div>
       <LocaleSwitcher locale={locale} />
     </aside>
diff --git a/admin-ui/src/middleware.ts b/admin-ui/src/middleware.ts
index f3b4048..f82508e 100644
--- a/admin-ui/src/middleware.ts
+++ b/admin-ui/src/middleware.ts
@@ -3,15 +3,7 @@ import type { NextRequest } from "next/server";
 import { getIronSession } from "iron-session";
 import { sessionOptions, type SessionData } from "@/lib/session";
 
-const PUBLIC_PREFIXES = ["/admin/login", "/admin/api/auth"];
-
 export async function middleware(request: NextRequest) {
-  const { pathname } = request.nextUrl;
-
-  if (PUBLIC_PREFIXES.some((p) => pathname.startsWith(p))) {
-    return NextResponse.next();
-  }
-
   const response = NextResponse.next();
   const session = await getIronSession<SessionData>(request, response, sessionOptions);
 
@@ -23,6 +15,11 @@ export async function middleware(request: NextRequest) {
   return response;
 }
 
+// Next.js prepends basePath (/admin) to these patterns automatically.
+// "/" matches /admin, "/((?!login|api/auth|_next|favicon.ico).+)" matches /admin/content/... etc.
 export const config = {
-  matcher: ["/admin", "/admin/((?!_next|favicon.ico).*)"],
+  matcher: [
+    "/",
+    "/((?!login|api/auth|_next|favicon.ico).+)",
+  ],
 };