@punch-in/strapi-admin 1.2.8 → 1.2.9

package/controllers/authentication.js

@@ -239,6 +239,14 @@ module.exports = {
   // time compare). Read-only: an unmatched or inactive email is rejected,
   // never used to create or activate an admin account.
   async ssoVerify(ctx) {
+    // TEMPORARY diagnostic - ssoVerify is returning a bare 403 "Forbidden"
+    // (matching isAuthenticatedAdmin's unmessaged strapi.errors.forbidden())
+    // in production on every tenant tested, even with a correct X-Sync-Secret,
+    // despite this route's routes.json entry having no policies that could
+    // produce that. This line proves whether the request even reaches this
+    // controller at all - remove once root-caused.
+    console.log('[ssoVerify] reached controller, headers:', JSON.stringify(ctx.request.header));
+
     const expected = process.env.SYNC_SECRET;
     if (!expected) {
       return ctx.internalServerError('SYNC_SECRET is not configured on this Strapi instance');

package/package.json

@@ -139,5 +139,5 @@
     "develop:ce": "STRAPI_DISABLE_EE=true webpack-dev-server --config webpack.config.dev.js",
     "test": "echo \"no tests yet\""
   },
-  "version": "1.2.8"
+  "version": "1.2.9"
 }