@zerotal/admin 1.5.0 → 1.5.1

package/CHANGELOG.md

@@ -8,6 +8,17 @@ follows the Zerotal monorepo's unified versioning.
 
 ## [Unreleased]
 
+## [1.5.1] — 2026-08-15
+
+### Fixed
+
+- **The development bypass never applied.** `AdminGuardMiddleware` and the `ability` helper
+  both read `APP_ENV` to decide whether this was a development environment — but by the time
+  either runs, `setAppEnv()` has replaced it with the runtime mode. So the panel refused
+  access in development exactly as it does in production, which is not what either was
+  written to do. Both ask `devSurfacesEnabled()` now, and both still fail closed anywhere
+  that is not explicitly a development environment.
+
 ## [1.5.0] — 2026-08-15
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/admin",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "license": "MIT",
   "maturity": "stable",
   "private": false,
@@ -31,16 +31,16 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zerotal/cache": "1.5.0",
-    "@zerotal/core": "1.5.0",
-    "@zerotal/flow": "1.5.0",
-    "@zerotal/flow-ui": "1.5.0",
-    "@zerotal/validator": "1.5.0"
+    "@zerotal/cache": "1.5.1",
+    "@zerotal/core": "1.5.1",
+    "@zerotal/flow": "1.5.1",
+    "@zerotal/flow-ui": "1.5.1",
+    "@zerotal/validator": "1.5.1"
   },
   "devDependencies": {
-    "@zerotal/orm": "1.5.0",
-    "@zerotal/auth": "1.5.0",
-    "@zerotal/queue": "1.5.0"
+    "@zerotal/orm": "1.5.1",
+    "@zerotal/auth": "1.5.1",
+    "@zerotal/queue": "1.5.1"
   },
   "peerDependencies": {
     "@zerotal/orm": "^1.0.0",

package/src/provider/AdminGuardMiddleware.ts

@@ -1,4 +1,4 @@
-import { BaseMiddleware, isDevSurfaceAllowed } from "@zerotal/core";
+import { BaseMiddleware, devSurfacesEnabled } from "@zerotal/core";
 import type { NextFn, HttpContext } from "@zerotal/core";
 
 /**
@@ -19,7 +19,9 @@ export class AdminGuardMiddleware extends BaseMiddleware {
   protected options = {};
 
   async handle(_http: HttpContext, next: NextFn): Promise<Response | void> {
-    if (isDevSurfaceAllowed(Bun.env["APP_ENV"] ?? "")) return next();
+    // `devSurfacesEnabled()` — `APP_ENV` holds the runtime mode by now, so reading it
+    // directly asked whether "web" is a development environment and always said no.
+    if (devSurfacesEnabled()) return next();
     return new Response(
       "Admin panel is not accessible: no authentication is configured.\n" +
         "Set `middleware` in config/admin.ts to a real auth guard before exposing it.\n",

package/src/support/ability.ts

@@ -20,7 +20,7 @@
  * put a page in the sidebar, but it cannot put one in front of a production user
  * who has no authorization configured.
  */
-import { tryCurrentApp, isDevSurfaceAllowed } from "@zerotal/core";
+import { tryCurrentApp, devSurfacesEnabled } from "@zerotal/core";
 
 /**
  * The slice of `@zerotal/auth`'s `GateService` the panel uses. Declared locally
@@ -69,5 +69,5 @@ export async function resolveAbility(
     return false;
   }
 
-  return isDevSurfaceAllowed(Bun.env["APP_ENV"] ?? "");
+  return devSurfacesEnabled();
 }