vliaudatandClaude Opus 5
5c0b8119a4
A React server action POSTs to the URL of the page it lives on, so the middleware's method check over /admin refused every form on the site to a viewer — including the sign-out button, which surfaced as "an unexpected response was received from the server". Gating pages by HTTP method was the wrong instrument: at the edge there is no way to tell a form that changes the shop's hours from one that ends a session. The method check now applies to /api/admin only, and page-level writes are authorised inside the actions themselves, where the intent is actually known. lib/auth/actions.ts carries that check and returns an error rather than throwing, since "you do not have permission" is a normal outcome and not a crash. The edge decision moves into a pure function with a regression test for this exact case. These rules are short, but they are the only thing in front of the administration and one of them has now been got wrong once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd