- Shipped
- August 3, 2026 at 10:26 AM UTC
- Author
- kamo
- Commit
- ef17e2f
checkAccess resolves the tenant by looking up `org:domain:<hostname>`, and was being handed request.nextUrl.hostname — which behind Traefik is 127.0.0.1. That key never exists, so every request took the "no org context for hostname" branch and was allowed. The IP allow/deny and temp-block control has therefore never applied to anything. Safe to correct rather than defer: an audit of the live Redis found zero `access:rules:*` and zero `org:domain:*` keys, so no tenant has rules configured and no domain mapping exists. Behaviour is byte-identical today — every request still takes the same branch — and the control becomes correct for whenever rules are first configured, instead of silently never applying. (The audit itself needed care: redis-cli is not on the node, so an earlier scan returned zeros that meant "command not found" rather than "no keys". Re-run inside the redis pod, where AVA:v1:* correctly showed the 2 cached avatars.) Host derivation is now in one place, requestHost(), shared with the image policy. Those two had derived it separately and got it wrong in two different ways — the image policy took the last two labels of "127.0.0.1" and emitted a CSP allowing "theme.0.0", which blocked every tenant's images for hours.