botrun-horse 2.29.2 → 2.30.0

package/botrun-c/web/lib/firebase-capacitor.ts

@@ -0,0 +1,135 @@
+// Capacitor Firebase Authentication for iOS/Android
+import { Capacitor } from '@capacitor/core';
+import { FirebaseAuthentication } from '@capacitor-firebase/authentication';
+import type { User } from 'firebase/auth';
+
+// 版本號：用於確認更新是否生效
+const FIREBASE_CAPACITOR_VERSION = '2.1.0-fix-getIdToken';
+console.log(`[firebase-capacitor] 🔄 Module loaded - Version: ${FIREBASE_CAPACITOR_VERSION}`);
+
+export const isNativePlatform = () => {
+  const isNative = Capacitor.isNativePlatform();
+  console.log('[Capacitor] Platform check:', {
+    isNative,
+    platform: Capacitor.getPlatform(),
+  });
+  return isNative;
+};
+
+export const signInWithGoogleNative = async (): Promise<User | null> => {
+  try {
+    console.log(`[Firebase Capacitor] 🚀 Starting Google Sign-In - Version: ${FIREBASE_CAPACITOR_VERSION}`);
+    console.log('[Firebase Capacitor] Calling FirebaseAuthentication.signInWithGoogle()...');
+
+    const result = await FirebaseAuthentication.signInWithGoogle();
+    console.log('[Firebase Capacitor] signInWithGoogle returned:', result);
+
+    console.log('[Firebase Capacitor] ✅ Sign-In successful:', {
+      uid: result.user?.uid,
+      email: result.user?.email,
+      displayName: result.user?.displayName,
+    });
+
+    // 轉換為 Firebase User 格式
+    const user: User = {
+      uid: result.user?.uid || '',
+      email: result.user?.email || null,
+      emailVerified: result.user?.emailVerified || false,
+      displayName: result.user?.displayName || null,
+      photoURL: result.user?.photoUrl || null,
+      phoneNumber: result.user?.phoneNumber || null,
+      isAnonymous: result.user?.isAnonymous || false,
+      tenantId: result.user?.tenantId || null,
+      providerData: [],
+      metadata: {} as any,
+      refreshToken: '',
+      providerId: 'google.com',
+      delete: async () => {},
+      getIdToken: async (forceRefresh?: boolean) => {
+        try {
+          console.log('[Firebase Capacitor] 🔐 Getting ID token...');
+          const tokenResult = await FirebaseAuthentication.getIdToken({ forceRefresh: forceRefresh || false });
+          console.log('[Firebase Capacitor] ✅ ID token obtained, length:', tokenResult.token?.length || 0);
+          return tokenResult.token || '';
+        } catch (error) {
+          console.error('[Firebase Capacitor] ❌ Failed to get ID token:', error);
+          return '';
+        }
+      },
+      getIdTokenResult: async () => ({} as any),
+      reload: async () => {},
+      toJSON: () => ({}),
+    };
+
+    return user;
+  } catch (error) {
+    console.error('[Firebase Capacitor] ❌ Sign-In failed:', error);
+    throw error;
+  }
+};
+
+export const signOutNative = async (): Promise<void> => {
+  try {
+    console.log(`[Firebase Capacitor] 🚪 Signing out - Version: ${FIREBASE_CAPACITOR_VERSION}`);
+    await FirebaseAuthentication.signOut();
+    console.log('[Firebase Capacitor] ✅ Signed out successfully');
+  } catch (error) {
+    console.error('[Firebase Capacitor] ❌ Sign-Out failed:', error);
+    throw error;
+  }
+};
+
+export const getCurrentUserNative = async (): Promise<User | null> => {
+  try {
+    console.log(`[Firebase Capacitor] 🔍 Getting current user - Version: ${FIREBASE_CAPACITOR_VERSION}`);
+
+    const result = await FirebaseAuthentication.getCurrentUser();
+    console.log('[Firebase Capacitor] getCurrentUser returned:', result);
+
+    if (!result.user) {
+      console.log('[Firebase Capacitor] No current user');
+      return null;
+    }
+
+    console.log('[Firebase Capacitor] Current user:', {
+      uid: result.user.uid,
+      email: result.user.email,
+    });
+
+    // 轉換為 Firebase User 格式
+    const user: User = {
+      uid: result.user.uid || '',
+      email: result.user.email || null,
+      emailVerified: result.user.emailVerified || false,
+      displayName: result.user.displayName || null,
+      photoURL: result.user.photoUrl || null,
+      phoneNumber: result.user.phoneNumber || null,
+      isAnonymous: result.user.isAnonymous || false,
+      tenantId: result.user.tenantId || null,
+      providerData: [],
+      metadata: {} as any,
+      refreshToken: '',
+      providerId: 'google.com',
+      delete: async () => {},
+      getIdToken: async (forceRefresh?: boolean) => {
+        try {
+          console.log('[Firebase Capacitor] 🔐 Getting ID token...');
+          const tokenResult = await FirebaseAuthentication.getIdToken({ forceRefresh: forceRefresh || false });
+          console.log('[Firebase Capacitor] ✅ ID token obtained, length:', tokenResult.token?.length || 0);
+          return tokenResult.token || '';
+        } catch (error) {
+          console.error('[Firebase Capacitor] ❌ Failed to get ID token:', error);
+          return '';
+        }
+      },
+      getIdTokenResult: async () => ({} as any),
+      reload: async () => {},
+      toJSON: () => ({}),
+    };
+
+    return user;
+  } catch (error) {
+    console.error('[Firebase Capacitor] ❌ Get current user failed:', error);
+    return null;
+  }
+};

package/botrun-c/web/lib/firebase.ts

@@ -0,0 +1,137 @@
+import { initializeApp, getApps, getApp, FirebaseApp } from 'firebase/app';
+import { getAuth, Auth, GoogleAuthProvider } from 'firebase/auth';
+import { Capacitor } from '@capacitor/core';
+
+const firebaseConfig = {
+  apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY,
+  authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,
+  projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
+  storageBucket: process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET,
+  messagingSenderId: process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID,
+  appId: process.env.NEXT_PUBLIC_FIREBASE_APP_ID,
+  measurementId: process.env.NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID,
+};
+
+let app: FirebaseApp | undefined;
+let auth: Auth | undefined;
+let _googleProvider: GoogleAuthProvider | undefined;
+
+// 檢查是否為原生平台
+const isNative = Capacitor.isNativePlatform();
+
+// 初始化 Firebase App 的函數，確保只在客戶端執行
+function initializeFirebaseClient() {
+  if (typeof window !== 'undefined') {
+    // 檢查是否在瀏覽器環境
+    console.log('[Firebase] Initializing Firebase client...');
+    console.log('[Firebase] Platform:', isNative ? 'Native (Capacitor)' : 'Web');
+    console.log('[Firebase] Config check:', {
+      hasApiKey: !!firebaseConfig.apiKey,
+      hasAuthDomain: !!firebaseConfig.authDomain,
+      hasProjectId: !!firebaseConfig.projectId,
+      apiKeyPrefix: firebaseConfig.apiKey?.substring(0, 10),
+      authDomain: firebaseConfig.authDomain,
+      projectId: firebaseConfig.projectId,
+    });
+
+    // 如果是原生平台，只初始化 Firebase App，不初始化 Web Auth
+    if (isNative) {
+      console.log('[Firebase] ⚠️  Native platform detected - skipping Firebase Web Auth initialization');
+      console.log('[Firebase] Native auth will be handled by @capacitor-firebase/authentication');
+
+      // 只初始化 Firebase App（用於其他 Firebase 服務，如 Firestore）
+      if (!getApps().length) {
+        try {
+          app = initializeApp(firebaseConfig);
+          console.log('[Firebase] ✅ Firebase app initialized (native mode)');
+        } catch (error) {
+          console.error('[Firebase] ❌ Failed to initialize Firebase app:', error);
+        }
+      }
+      return; // 不初始化 Web Auth 和 GoogleProvider
+    }
+
+    // Web 平台：正常初始化
+    // 檢查必要的配置
+    if (!firebaseConfig.apiKey || !firebaseConfig.authDomain || !firebaseConfig.projectId) {
+      const errorMsg = `[Firebase] ❌ Missing config - apiKey: ${firebaseConfig.apiKey ? 'SET' : 'MISSING'}, authDomain: ${firebaseConfig.authDomain || 'MISSING'}, projectId: ${firebaseConfig.projectId || 'MISSING'}`;
+      console.error(errorMsg);
+      console.error('[Firebase] ❌ Firebase will not be initialized. Check environment variables.');
+      return;
+    }
+
+    // 成功讀取配置
+    console.log('[Firebase] ✅ Config loaded successfully!', {
+      authDomain: firebaseConfig.authDomain,
+      projectId: firebaseConfig.projectId,
+    });
+
+    if (!getApps().length) {
+      console.log('[Firebase] No existing app found, creating new Firebase app');
+      try {
+        app = initializeApp(firebaseConfig);
+        console.log('[Firebase] ✅ Firebase app initialized successfully');
+      } catch (error) {
+        console.error('[Firebase] ❌ Failed to initialize Firebase app:', error);
+        return;
+      }
+    } else {
+      app = getApp();
+      console.log('[Firebase] ✅ Using existing Firebase app');
+    }
+
+    // 確保 app 已成功初始化才獲取 auth
+    if (app && !auth) {
+      try {
+        auth = getAuth(app);
+        console.log('[Firebase] ✅ Firebase Auth initialized successfully');
+      } catch (error) {
+        console.error('[Firebase] ❌ Failed to initialize Firebase Auth:', error);
+        auth = undefined;
+      }
+    }
+  } else {
+    console.log('[Firebase] Skipping initialization (not in browser environment)');
+  }
+}
+
+// 在模組載入時呼叫一次初始化函數
+initializeFirebaseClient();
+
+// 提供一個獲取 auth 實例的函數
+export function getClientAuth(): Auth | undefined {
+  if (!auth && typeof window !== 'undefined' && !isNative) {
+    console.warn('[Firebase] Auth is not initialized. This may be due to an earlier error.');
+  }
+  return auth;
+}
+
+// 提供一個獲取 Google Provider 的函數（只在 Web 平台創建）
+export function getGoogleProvider(): GoogleAuthProvider | undefined {
+  if (isNative) {
+    console.warn('[Firebase] GoogleProvider is not available on native platform. Use signInWithGoogleNative() instead.');
+    return undefined;
+  }
+
+  // Lazy initialization: 只在 Web 平台且第一次呼叫時創建
+  if (!_googleProvider && typeof window !== 'undefined') {
+    console.log('[Firebase] Creating GoogleAuthProvider for web platform');
+    _googleProvider = new GoogleAuthProvider();
+    _googleProvider.setCustomParameters({
+      prompt: 'select_account'
+    });
+  }
+
+  return _googleProvider;
+}
+
+// 為了向後相容，export 一個 proxy
+export const googleProvider = new Proxy({} as GoogleAuthProvider, {
+  get(target, prop) {
+    const provider = getGoogleProvider();
+    if (!provider) {
+      throw new Error('GoogleProvider is not available on native platform');
+    }
+    return (provider as any)[prop];
+  }
+});

package/botrun-c/web/lib/firestore-auth.ts

@@ -0,0 +1,61 @@
+/**
+ * Firestore Authentication & Authorization Utilities
+ * 簡化版：只要 Gmail 登入即可使用
+ *
+ * 🔑 架構說明：
+ * - 任何 Google 帳號都可以登入使用
+ * - 不需要白名單驗證
+ * - 不需要使用者文件設定
+ */
+
+import { User } from 'firebase/auth';
+
+/**
+ * 檢查使用者是否有權存取當前服務
+ * 簡化版：任何 Gmail 登入即可使用
+ */
+export async function checkServiceAccess(email: string): Promise<{
+  allowed: boolean;
+  error?: string;
+}> {
+  try {
+    console.log('✅ [Service Access] Gmail 登入成功:', email);
+    console.log('✅ [Service Access] 任何 Google 帳號都可以使用此系統');
+
+    // 直接允許存取
+    return {
+      allowed: true,
+    };
+  } catch (error) {
+    console.error('❌ [Service Access] Error:', error);
+    return {
+      allowed: false,
+      error: '系統錯誤，請稍後再試。',
+    };
+  }
+}
+
+/**
+ * 檢查 Firebase Token 中的 Custom Claims
+ * 簡化版：不檢查 Custom Claims，直接允許
+ */
+export async function checkCustomClaims(user: User): Promise<{
+  valid: boolean;
+  error?: string;
+}> {
+  try {
+    console.log('✅ [Auth] 使用者已登入:', user.email);
+    console.log('✅ [Auth] 任何 Google 帳號都可以使用此系統');
+
+    // 直接允許
+    return {
+      valid: true,
+    };
+  } catch (error) {
+    console.error('❌ [Auth] Error:', error);
+    return {
+      valid: false,
+      error: '無法驗證您的權限。請重新登入。',
+    };
+  }
+}

package/botrun-c/web/lib/firestore-auth.ts.migration-bak

@@ -0,0 +1,319 @@
+/**
+ * Firestore Authentication & Authorization Utilities
+ * 檢查使用者是否在白名單、是否有權存取當前服務
+ *
+ * 🔑 架構說明：
+ * - 統一使用 scoop-386004 專案處理 Auth 和 Firestore
+ * - 簡化為單一 Firebase 專案，避免跨專案複雜度
+ */
+
+import { User } from 'firebase/auth';
+import { getFirestore, doc, getDoc } from 'firebase/firestore';
+import { getFirebaseApp } from './firebase';
+
+export interface UserData {
+  email: string;
+  allowedService: string;
+  serviceUrl: string;
+  bucketName: string;
+  bucketHash: string;
+  role: string;
+  displayName?: string;
+  loginMethods: string[];
+  active: boolean;
+  createdAt: any;
+  updatedAt: any;
+}
+
+export interface SystemAllowedUsers {
+  emails: string[];
+  updatedAt: any;
+  updatedBy: string;
+}
+
+/**
+ * 檢查使用者是否在系統白名單中
+ */
+export async function isUserInWhitelist(email: string): Promise<boolean> {
+  try {
+    console.log('🔄 [Firestore] Checking whitelist for:', email);
+    console.log('🔧 [Firestore] Using project:', process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID);
+    const db = getFirestore(getFirebaseApp());
+    console.log('✅ [Firestore] Firestore instance created');
+    const systemRef = doc(db, 'system', 'allowedUsers');
+    console.log('📋 [Firestore] Document path: system/allowedUsers');
+
+    console.log('📋 [Firestore] Fetching allowedUsers document...');
+    const systemDoc = await getDoc(systemRef);
+
+    if (!systemDoc.exists()) {
+      console.warn('⚠️ [Firestore] System allowedUsers document not found');
+      return false;
+    }
+
+    const data = systemDoc.data() as SystemAllowedUsers;
+    const isAllowed = data.emails?.includes(email) || false;
+
+    console.log(`✅ [Firestore] Whitelist check for ${email}: ${isAllowed}`);
+    console.log('📊 [Firestore] Total allowed users:', data.emails?.length || 0);
+    return isAllowed;
+  } catch (error) {
+    console.error('❌ [Firestore] Error checking whitelist:', error);
+    console.error('📍 [Firestore] Error details:', JSON.stringify(error, null, 2));
+    return false;
+  }
+}
+
+/**
+ * 取得使用者資料
+ */
+export async function getUserData(email: string): Promise<UserData | null> {
+  try {
+    console.log('🔄 [Firestore] Fetching user data for:', email);
+    console.log('🔧 [Firestore] Using project:', process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID);
+    const db = getFirestore(getFirebaseApp());
+    console.log('✅ [Firestore] Firestore instance created');
+    const userRef = doc(db, 'users', email);
+    console.log('📋 [Firestore] Document path: users/' + email);
+
+    console.log('📋 [Firestore] Querying users collection...');
+    const userDoc = await getDoc(userRef);
+
+    if (!userDoc.exists()) {
+      console.warn(`⚠️ [Firestore] User document not found: ${email}`);
+      return null;
+    }
+
+    const data = userDoc.data() as UserData;
+    console.log(`✅ [Firestore] User data loaded:`);
+    console.log('   Email:', data.email);
+    console.log('   Service:', data.allowedService);
+    console.log('   Active:', data.active);
+    return data;
+  } catch (error) {
+    console.error('❌ [Firestore] Error fetching user data:', error);
+    console.error('📍 [Firestore] Error details:', JSON.stringify(error, null, 2));
+    return null;
+  }
+}
+
+/**
+ * 檢查使用者是否有權存取當前服務
+ */
+export async function checkServiceAccess(email: string): Promise<{
+  allowed: boolean;
+  userData?: UserData;
+  error?: string;
+  redirectUrl?: string;
+}> {
+  try {
+    console.log('🔄 [Service Access] Starting service access check for:', email);
+
+    // 1. 檢查白名單
+    console.log('🔄 [Service Access] Step 1/4: Checking whitelist...');
+    const inWhitelist = await isUserInWhitelist(email);
+    if (!inWhitelist) {
+      console.error('❌ [Service Access] User not in whitelist');
+      return {
+        allowed: false,
+        error: '您的帳號未被授權使用此系統。請聯絡管理員。',
+      };
+    }
+    console.log('✅ [Service Access] User is in whitelist');
+
+    // 2. 取得使用者資料
+    console.log('🔄 [Service Access] Step 2/4: Fetching user data...');
+    const userData = await getUserData(email);
+    if (!userData) {
+      console.error('❌ [Service Access] User data not found');
+      return {
+        allowed: false,
+        error: '找不到您的使用者設定。請聯絡管理員。',
+      };
+    }
+    console.log('✅ [Service Access] User data retrieved');
+
+    // 3. 檢查是否為 active
+    console.log('🔄 [Service Access] Step 3/4: Checking user active status...');
+    if (!userData.active) {
+      console.error('❌ [Service Access] User account is inactive');
+      return {
+        allowed: false,
+        error: '您的帳號已被停用。請聯絡管理員。',
+      };
+    }
+    console.log('✅ [Service Access] User account is active');
+
+    // 4. 檢查當前 Service 與儲存使用者專屬 API URL
+    console.log('🔄 [Service Access] Step 4/4: Service validation...');
+    const currentHostname = window.location.hostname;
+
+    // 🎯 正確的域名格式判斷：
+    // 統一前端: j.cameo.tw (Load Balancer) 或 botrun-j-{revision}.asia-northeast1.run.app (東京)
+    // 個人後端: j.cameo.tw/u/{hash}/ (Load Balancer) 或 botrun-j-{hash}-{revision}.asia-east1.run.app (台灣)
+
+    const pathname = window.location.pathname;
+    const isUnifiedFrontend =
+      currentHostname === 'j.cameo.tw' && !pathname.startsWith('/u/') ||  // Load Balancer 統一前端
+      currentHostname.includes('.asia-northeast1.run.app') ||              // 舊的 Cloud Run 統一前端
+      currentHostname === 'localhost';                                     // 開發環境
+
+    // 提取 service hash (8位16進制) - 只在個人後端有效
+    let currentServiceHash: string | null = null;
+
+    if (currentHostname === 'j.cameo.tw') {
+      // Load Balancer URL: j.cameo.tw/u/{hash}/
+      const pathnameHashMatch = pathname.match(/^\/u\/([0-9a-f]{8})/);
+      currentServiceHash = pathnameHashMatch ? pathnameHashMatch[1] : null;
+    } else {
+      // 舊的 Cloud Run URL: botrun-j-{hash}-{revision}.asia-east1.run.app
+      const hostnameHashMatch = currentHostname.match(/botrun-j-([0-9a-f]{8})-\d+\.asia-east1\.run\.app/);
+      currentServiceHash = hostnameHashMatch ? hostnameHashMatch[1] : null;
+    }
+
+    const allowedServiceHash = userData.bucketHash;
+
+    console.log('🔍 [Service Access] Service info:');
+    console.log(`   Current hostname: ${currentHostname}`);
+    console.log(`   Is unified frontend: ${isUnifiedFrontend}`);
+    console.log(`   Current hash: ${currentServiceHash || '(統一前端)'}`);
+    console.log(`   User's allowed service: ${userData.allowedService}`);
+    console.log(`   User's service URL: ${userData.serviceUrl}`);
+    console.log(`   User's bucket hash: ${allowedServiceHash}`);
+
+    // 📌 新架構：統一前端作為登入入口，登入後重定向到個人後端
+    // userData.serviceUrl 用於重定向目標
+    if (isUnifiedFrontend) {
+      console.log('✅ [Service Access] 統一前端 - 允許登入');
+      console.log('📍 [Service Access] 使用者將重定向到: ' + userData.serviceUrl);
+      // 允許登入，userData 包含 serviceUrl 供重定向使用
+      return {
+        allowed: true,
+        userData,  // 包含 serviceUrl，AuthContext 會用來重定向
+      };
+    }
+
+    // 如果使用者直接訪問專屬服務 URL，檢查 hash 是否匹配
+    if (currentServiceHash !== allowedServiceHash) {
+      console.warn('⚠️ [Service Access] 訪問了其他使用者的專屬服務');
+      return {
+        allowed: false,
+        userData,
+        error: `您的帳號授權使用 ${userData.allowedService}，請使用主服務登入。`,
+      };
+    }
+    console.log('✅ [Service Access] 訪問自己的專屬服務（允許）');
+
+    // 5. 所有檢查通過
+    console.log('✅ [Service Access] ALL CHECKS PASSED');
+    return {
+      allowed: true,
+      userData,
+    };
+  } catch (error) {
+    console.error('❌ [Service Access] Error checking service access:', error);
+    console.error('📍 [Service Access] Error details:', JSON.stringify(error, null, 2));
+    return {
+      allowed: false,
+      error: '系統錯誤，請稍後再試。',
+    };
+  }
+}
+
+/**
+ * 檢查 Firebase Token 中的 Custom Claims
+ */
+export async function checkCustomClaims(user: User): Promise<{
+  valid: boolean;
+  allowedService?: string;
+  error?: string;
+}> {
+  try {
+    console.log('🔄 [Custom Claims] Starting custom claims check for:', user.email);
+    console.log('⏱️ [Custom Claims] Fetching ID token result...');
+
+    const tokenResult = await user.getIdTokenResult();
+    const claims = tokenResult.claims;
+
+    console.log(`✅ [Custom Claims] Token retrieved`);
+    console.log('📋 [Custom Claims] Claims:', claims);
+
+    // 檢查是否有 allowedService claim
+    if (!claims.allowedService) {
+      console.warn('⚠️ [Custom Claims] No allowedService claim (might be a new user)');
+      return {
+        valid: false,
+        error: '您的帳號尚未完成設定。請登出後重新登入，或聯絡管理員。',
+      };
+    }
+
+    // 檢查當前服務是否符合
+    const currentHostname = window.location.hostname;
+
+    // 🎯 正確的域名格式判斷：
+    // 統一前端: j.cameo.tw (Load Balancer) 或 botrun-j-{revision}.asia-northeast1.run.app (東京)
+    // 個人後端: j.cameo.tw/u/{hash}/ (Load Balancer) 或 botrun-j-{hash}-{revision}.asia-east1.run.app (台灣)
+
+    // 判斷是否為統一前端
+    const pathname = window.location.pathname;
+    const isUnifiedFrontend =
+      currentHostname === 'j.cameo.tw' && !pathname.startsWith('/u/') ||  // Load Balancer 統一前端
+      currentHostname.includes('.asia-northeast1.run.app') ||              // 舊的 Cloud Run 統一前端
+      currentHostname === 'localhost';                                     // 開發環境
+
+    // 提取 service hash (8位16進制) - 只在個人後端有效
+    let currentServiceHash: string | null = null;
+
+    if (currentHostname === 'j.cameo.tw') {
+      // Load Balancer URL: j.cameo.tw/u/{hash}/
+      const pathnameHashMatch = pathname.match(/^\/u\/([0-9a-f]{8})/);
+      currentServiceHash = pathnameHashMatch ? pathnameHashMatch[1] : null;
+    } else {
+      // 舊的 Cloud Run URL: botrun-j-{hash}-{revision}.asia-east1.run.app
+      const hostnameHashMatch = currentHostname.match(/botrun-j-([0-9a-f]{8})-\d+\.asia-east1\.run\.app/);
+      currentServiceHash = hostnameHashMatch ? hostnameHashMatch[1] : null;
+    }
+
+    const currentService = currentServiceHash ? `botrun-j-${currentServiceHash}` : null;
+
+    console.log('🔍 [Custom Claims] Service check:');
+    console.log('   Current hostname:', currentHostname);
+    console.log('   Is unified frontend:', isUnifiedFrontend);
+    console.log('   Extracted hash:', currentServiceHash || '(none)');
+    console.log('   Current service:', currentService || '(統一前端)');
+    console.log('   Allowed service:', claims.allowedService);
+
+    // 📌 新架構：統一前端作為登入入口，允許所有使用者登入
+    if (isUnifiedFrontend) {
+      console.log('✅ [Custom Claims] 統一前端 - 允許登入，準備重定向');
+      console.log('📍 [Custom Claims] 使用者應前往: ' + claims.allowedService);
+      return {
+        valid: true,
+        allowedService: claims.allowedService as string,
+      };
+    }
+
+    // 如果使用者直接訪問專屬服務，檢查是否匹配
+    if (claims.allowedService !== currentService) {
+      console.error('❌ [Custom Claims] 訪問了其他使用者的專屬服務');
+      return {
+        valid: false,
+        allowedService: claims.allowedService as string,
+        error: `您的帳號授權使用 ${claims.allowedService}，請使用主服務登入。`,
+      };
+    }
+
+    console.log('✅ [Custom Claims] All checks passed');
+    return {
+      valid: true,
+      allowedService: claims.allowedService as string,
+    };
+  } catch (error) {
+    console.error('❌ [Custom Claims] Error checking custom claims:', error);
+    console.error('📍 [Custom Claims] Error details:', JSON.stringify(error, null, 2));
+    return {
+      valid: false,
+      error: '無法驗證您的權限。請重新登入。',
+    };
+  }
+}