botrun-horse 2.30.0 → 2.34.0

package/botrun-c/web/lib/firebase-capacitor.ts

@@ -1,135 +0,0 @@
-// Capacitor Firebase Authentication for iOS/Android
-import { Capacitor } from '@capacitor/core';
-import { FirebaseAuthentication } from '@capacitor-firebase/authentication';
-import type { User } from 'firebase/auth';
-
-// 版本號：用於確認更新是否生效
-const FIREBASE_CAPACITOR_VERSION = '2.1.0-fix-getIdToken';
-console.log(`[firebase-capacitor] 🔄 Module loaded - Version: ${FIREBASE_CAPACITOR_VERSION}`);
-
-export const isNativePlatform = () => {
-  const isNative = Capacitor.isNativePlatform();
-  console.log('[Capacitor] Platform check:', {
-    isNative,
-    platform: Capacitor.getPlatform(),
-  });
-  return isNative;
-};
-
-export const signInWithGoogleNative = async (): Promise<User | null> => {
-  try {
-    console.log(`[Firebase Capacitor] 🚀 Starting Google Sign-In - Version: ${FIREBASE_CAPACITOR_VERSION}`);
-    console.log('[Firebase Capacitor] Calling FirebaseAuthentication.signInWithGoogle()...');
-
-    const result = await FirebaseAuthentication.signInWithGoogle();
-    console.log('[Firebase Capacitor] signInWithGoogle returned:', result);
-
-    console.log('[Firebase Capacitor] ✅ Sign-In successful:', {
-      uid: result.user?.uid,
-      email: result.user?.email,
-      displayName: result.user?.displayName,
-    });
-
-    // 轉換為 Firebase User 格式
-    const user: User = {
-      uid: result.user?.uid || '',
-      email: result.user?.email || null,
-      emailVerified: result.user?.emailVerified || false,
-      displayName: result.user?.displayName || null,
-      photoURL: result.user?.photoUrl || null,
-      phoneNumber: result.user?.phoneNumber || null,
-      isAnonymous: result.user?.isAnonymous || false,
-      tenantId: result.user?.tenantId || null,
-      providerData: [],
-      metadata: {} as any,
-      refreshToken: '',
-      providerId: 'google.com',
-      delete: async () => {},
-      getIdToken: async (forceRefresh?: boolean) => {
-        try {
-          console.log('[Firebase Capacitor] 🔐 Getting ID token...');
-          const tokenResult = await FirebaseAuthentication.getIdToken({ forceRefresh: forceRefresh || false });
-          console.log('[Firebase Capacitor] ✅ ID token obtained, length:', tokenResult.token?.length || 0);
-          return tokenResult.token || '';
-        } catch (error) {
-          console.error('[Firebase Capacitor] ❌ Failed to get ID token:', error);
-          return '';
-        }
-      },
-      getIdTokenResult: async () => ({} as any),
-      reload: async () => {},
-      toJSON: () => ({}),
-    };
-
-    return user;
-  } catch (error) {
-    console.error('[Firebase Capacitor] ❌ Sign-In failed:', error);
-    throw error;
-  }
-};
-
-export const signOutNative = async (): Promise<void> => {
-  try {
-    console.log(`[Firebase Capacitor] 🚪 Signing out - Version: ${FIREBASE_CAPACITOR_VERSION}`);
-    await FirebaseAuthentication.signOut();
-    console.log('[Firebase Capacitor] ✅ Signed out successfully');
-  } catch (error) {
-    console.error('[Firebase Capacitor] ❌ Sign-Out failed:', error);
-    throw error;
-  }
-};
-
-export const getCurrentUserNative = async (): Promise<User | null> => {
-  try {
-    console.log(`[Firebase Capacitor] 🔍 Getting current user - Version: ${FIREBASE_CAPACITOR_VERSION}`);
-
-    const result = await FirebaseAuthentication.getCurrentUser();
-    console.log('[Firebase Capacitor] getCurrentUser returned:', result);
-
-    if (!result.user) {
-      console.log('[Firebase Capacitor] No current user');
-      return null;
-    }
-
-    console.log('[Firebase Capacitor] Current user:', {
-      uid: result.user.uid,
-      email: result.user.email,
-    });
-
-    // 轉換為 Firebase User 格式
-    const user: User = {
-      uid: result.user.uid || '',
-      email: result.user.email || null,
-      emailVerified: result.user.emailVerified || false,
-      displayName: result.user.displayName || null,
-      photoURL: result.user.photoUrl || null,
-      phoneNumber: result.user.phoneNumber || null,
-      isAnonymous: result.user.isAnonymous || false,
-      tenantId: result.user.tenantId || null,
-      providerData: [],
-      metadata: {} as any,
-      refreshToken: '',
-      providerId: 'google.com',
-      delete: async () => {},
-      getIdToken: async (forceRefresh?: boolean) => {
-        try {
-          console.log('[Firebase Capacitor] 🔐 Getting ID token...');
-          const tokenResult = await FirebaseAuthentication.getIdToken({ forceRefresh: forceRefresh || false });
-          console.log('[Firebase Capacitor] ✅ ID token obtained, length:', tokenResult.token?.length || 0);
-          return tokenResult.token || '';
-        } catch (error) {
-          console.error('[Firebase Capacitor] ❌ Failed to get ID token:', error);
-          return '';
-        }
-      },
-      getIdTokenResult: async () => ({} as any),
-      reload: async () => {},
-      toJSON: () => ({}),
-    };
-
-    return user;
-  } catch (error) {
-    console.error('[Firebase Capacitor] ❌ Get current user failed:', error);
-    return null;
-  }
-};

package/botrun-c/web/lib/firebase.ts

@@ -1,137 +0,0 @@
-import { initializeApp, getApps, getApp, FirebaseApp } from 'firebase/app';
-import { getAuth, Auth, GoogleAuthProvider } from 'firebase/auth';
-import { Capacitor } from '@capacitor/core';
-
-const firebaseConfig = {
-  apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY,
-  authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,
-  projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
-  storageBucket: process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET,
-  messagingSenderId: process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID,
-  appId: process.env.NEXT_PUBLIC_FIREBASE_APP_ID,
-  measurementId: process.env.NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID,
-};
-
-let app: FirebaseApp | undefined;
-let auth: Auth | undefined;
-let _googleProvider: GoogleAuthProvider | undefined;
-
-// 檢查是否為原生平台
-const isNative = Capacitor.isNativePlatform();
-
-// 初始化 Firebase App 的函數，確保只在客戶端執行
-function initializeFirebaseClient() {
-  if (typeof window !== 'undefined') {
-    // 檢查是否在瀏覽器環境
-    console.log('[Firebase] Initializing Firebase client...');
-    console.log('[Firebase] Platform:', isNative ? 'Native (Capacitor)' : 'Web');
-    console.log('[Firebase] Config check:', {
-      hasApiKey: !!firebaseConfig.apiKey,
-      hasAuthDomain: !!firebaseConfig.authDomain,
-      hasProjectId: !!firebaseConfig.projectId,
-      apiKeyPrefix: firebaseConfig.apiKey?.substring(0, 10),
-      authDomain: firebaseConfig.authDomain,
-      projectId: firebaseConfig.projectId,
-    });
-
-    // 如果是原生平台，只初始化 Firebase App，不初始化 Web Auth
-    if (isNative) {
-      console.log('[Firebase] ⚠️  Native platform detected - skipping Firebase Web Auth initialization');
-      console.log('[Firebase] Native auth will be handled by @capacitor-firebase/authentication');
-
-      // 只初始化 Firebase App（用於其他 Firebase 服務，如 Firestore）
-      if (!getApps().length) {
-        try {
-          app = initializeApp(firebaseConfig);
-          console.log('[Firebase] ✅ Firebase app initialized (native mode)');
-        } catch (error) {
-          console.error('[Firebase] ❌ Failed to initialize Firebase app:', error);
-        }
-      }
-      return; // 不初始化 Web Auth 和 GoogleProvider
-    }
-
-    // Web 平台：正常初始化
-    // 檢查必要的配置
-    if (!firebaseConfig.apiKey || !firebaseConfig.authDomain || !firebaseConfig.projectId) {
-      const errorMsg = `[Firebase] ❌ Missing config - apiKey: ${firebaseConfig.apiKey ? 'SET' : 'MISSING'}, authDomain: ${firebaseConfig.authDomain || 'MISSING'}, projectId: ${firebaseConfig.projectId || 'MISSING'}`;
-      console.error(errorMsg);
-      console.error('[Firebase] ❌ Firebase will not be initialized. Check environment variables.');
-      return;
-    }
-
-    // 成功讀取配置
-    console.log('[Firebase] ✅ Config loaded successfully!', {
-      authDomain: firebaseConfig.authDomain,
-      projectId: firebaseConfig.projectId,
-    });
-
-    if (!getApps().length) {
-      console.log('[Firebase] No existing app found, creating new Firebase app');
-      try {
-        app = initializeApp(firebaseConfig);
-        console.log('[Firebase] ✅ Firebase app initialized successfully');
-      } catch (error) {
-        console.error('[Firebase] ❌ Failed to initialize Firebase app:', error);
-        return;
-      }
-    } else {
-      app = getApp();
-      console.log('[Firebase] ✅ Using existing Firebase app');
-    }
-
-    // 確保 app 已成功初始化才獲取 auth
-    if (app && !auth) {
-      try {
-        auth = getAuth(app);
-        console.log('[Firebase] ✅ Firebase Auth initialized successfully');
-      } catch (error) {
-        console.error('[Firebase] ❌ Failed to initialize Firebase Auth:', error);
-        auth = undefined;
-      }
-    }
-  } else {
-    console.log('[Firebase] Skipping initialization (not in browser environment)');
-  }
-}
-
-// 在模組載入時呼叫一次初始化函數
-initializeFirebaseClient();
-
-// 提供一個獲取 auth 實例的函數
-export function getClientAuth(): Auth | undefined {
-  if (!auth && typeof window !== 'undefined' && !isNative) {
-    console.warn('[Firebase] Auth is not initialized. This may be due to an earlier error.');
-  }
-  return auth;
-}
-
-// 提供一個獲取 Google Provider 的函數（只在 Web 平台創建）
-export function getGoogleProvider(): GoogleAuthProvider | undefined {
-  if (isNative) {
-    console.warn('[Firebase] GoogleProvider is not available on native platform. Use signInWithGoogleNative() instead.');
-    return undefined;
-  }
-
-  // Lazy initialization: 只在 Web 平台且第一次呼叫時創建
-  if (!_googleProvider && typeof window !== 'undefined') {
-    console.log('[Firebase] Creating GoogleAuthProvider for web platform');
-    _googleProvider = new GoogleAuthProvider();
-    _googleProvider.setCustomParameters({
-      prompt: 'select_account'
-    });
-  }
-
-  return _googleProvider;
-}
-
-// 為了向後相容，export 一個 proxy
-export const googleProvider = new Proxy({} as GoogleAuthProvider, {
-  get(target, prop) {
-    const provider = getGoogleProvider();
-    if (!provider) {
-      throw new Error('GoogleProvider is not available on native platform');
-    }
-    return (provider as any)[prop];
-  }
-});

package/botrun-c/web/lib/firestore-auth.ts

@@ -1,61 +0,0 @@
-/**
- * Firestore Authentication & Authorization Utilities
- * 簡化版：只要 Gmail 登入即可使用
- *
- * 🔑 架構說明：
- * - 任何 Google 帳號都可以登入使用
- * - 不需要白名單驗證
- * - 不需要使用者文件設定
- */
-
-import { User } from 'firebase/auth';
-
-/**
- * 檢查使用者是否有權存取當前服務
- * 簡化版：任何 Gmail 登入即可使用
- */
-export async function checkServiceAccess(email: string): Promise<{
-  allowed: boolean;
-  error?: string;
-}> {
-  try {
-    console.log('✅ [Service Access] Gmail 登入成功:', email);
-    console.log('✅ [Service Access] 任何 Google 帳號都可以使用此系統');
-
-    // 直接允許存取
-    return {
-      allowed: true,
-    };
-  } catch (error) {
-    console.error('❌ [Service Access] Error:', error);
-    return {
-      allowed: false,
-      error: '系統錯誤，請稍後再試。',
-    };
-  }
-}
-
-/**
- * 檢查 Firebase Token 中的 Custom Claims
- * 簡化版：不檢查 Custom Claims，直接允許
- */
-export async function checkCustomClaims(user: User): Promise<{
-  valid: boolean;
-  error?: string;
-}> {
-  try {
-    console.log('✅ [Auth] 使用者已登入:', user.email);
-    console.log('✅ [Auth] 任何 Google 帳號都可以使用此系統');
-
-    // 直接允許
-    return {
-      valid: true,
-    };
-  } catch (error) {
-    console.error('❌ [Auth] Error:', error);
-    return {
-      valid: false,
-      error: '無法驗證您的權限。請重新登入。',
-    };
-  }
-}

package/botrun-c/web/lib/firestore-auth.ts.migration-bak

@@ -1,319 +0,0 @@
-/**
- * Firestore Authentication & Authorization Utilities
- * 檢查使用者是否在白名單、是否有權存取當前服務
- *
- * 🔑 架構說明：
- * - 統一使用 scoop-386004 專案處理 Auth 和 Firestore
- * - 簡化為單一 Firebase 專案，避免跨專案複雜度
- */
-
-import { User } from 'firebase/auth';
-import { getFirestore, doc, getDoc } from 'firebase/firestore';
-import { getFirebaseApp } from './firebase';
-
-export interface UserData {
-  email: string;
-  allowedService: string;
-  serviceUrl: string;
-  bucketName: string;
-  bucketHash: string;
-  role: string;
-  displayName?: string;
-  loginMethods: string[];
-  active: boolean;
-  createdAt: any;
-  updatedAt: any;
-}
-
-export interface SystemAllowedUsers {
-  emails: string[];
-  updatedAt: any;
-  updatedBy: string;
-}
-
-/**
- * 檢查使用者是否在系統白名單中
- */
-export async function isUserInWhitelist(email: string): Promise<boolean> {
-  try {
-    console.log('🔄 [Firestore] Checking whitelist for:', email);
-    console.log('🔧 [Firestore] Using project:', process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID);
-    const db = getFirestore(getFirebaseApp());
-    console.log('✅ [Firestore] Firestore instance created');
-    const systemRef = doc(db, 'system', 'allowedUsers');
-    console.log('📋 [Firestore] Document path: system/allowedUsers');
-
-    console.log('📋 [Firestore] Fetching allowedUsers document...');
-    const systemDoc = await getDoc(systemRef);
-
-    if (!systemDoc.exists()) {
-      console.warn('⚠️ [Firestore] System allowedUsers document not found');
-      return false;
-    }
-
-    const data = systemDoc.data() as SystemAllowedUsers;
-    const isAllowed = data.emails?.includes(email) || false;
-
-    console.log(`✅ [Firestore] Whitelist check for ${email}: ${isAllowed}`);
-    console.log('📊 [Firestore] Total allowed users:', data.emails?.length || 0);
-    return isAllowed;
-  } catch (error) {
-    console.error('❌ [Firestore] Error checking whitelist:', error);
-    console.error('📍 [Firestore] Error details:', JSON.stringify(error, null, 2));
-    return false;
-  }
-}
-
-/**
- * 取得使用者資料
- */
-export async function getUserData(email: string): Promise<UserData | null> {
-  try {
-    console.log('🔄 [Firestore] Fetching user data for:', email);
-    console.log('🔧 [Firestore] Using project:', process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID);
-    const db = getFirestore(getFirebaseApp());
-    console.log('✅ [Firestore] Firestore instance created');
-    const userRef = doc(db, 'users', email);
-    console.log('📋 [Firestore] Document path: users/' + email);
-
-    console.log('📋 [Firestore] Querying users collection...');
-    const userDoc = await getDoc(userRef);
-
-    if (!userDoc.exists()) {
-      console.warn(`⚠️ [Firestore] User document not found: ${email}`);
-      return null;
-    }
-
-    const data = userDoc.data() as UserData;
-    console.log(`✅ [Firestore] User data loaded:`);
-    console.log('   Email:', data.email);
-    console.log('   Service:', data.allowedService);
-    console.log('   Active:', data.active);
-    return data;
-  } catch (error) {
-    console.error('❌ [Firestore] Error fetching user data:', error);
-    console.error('📍 [Firestore] Error details:', JSON.stringify(error, null, 2));
-    return null;
-  }
-}
-
-/**
- * 檢查使用者是否有權存取當前服務
- */
-export async function checkServiceAccess(email: string): Promise<{
-  allowed: boolean;
-  userData?: UserData;
-  error?: string;
-  redirectUrl?: string;
-}> {
-  try {
-    console.log('🔄 [Service Access] Starting service access check for:', email);
-
-    // 1. 檢查白名單
-    console.log('🔄 [Service Access] Step 1/4: Checking whitelist...');
-    const inWhitelist = await isUserInWhitelist(email);
-    if (!inWhitelist) {
-      console.error('❌ [Service Access] User not in whitelist');
-      return {
-        allowed: false,
-        error: '您的帳號未被授權使用此系統。請聯絡管理員。',
-      };
-    }
-    console.log('✅ [Service Access] User is in whitelist');
-
-    // 2. 取得使用者資料
-    console.log('🔄 [Service Access] Step 2/4: Fetching user data...');
-    const userData = await getUserData(email);
-    if (!userData) {
-      console.error('❌ [Service Access] User data not found');
-      return {
-        allowed: false,
-        error: '找不到您的使用者設定。請聯絡管理員。',
-      };
-    }
-    console.log('✅ [Service Access] User data retrieved');
-
-    // 3. 檢查是否為 active
-    console.log('🔄 [Service Access] Step 3/4: Checking user active status...');
-    if (!userData.active) {
-      console.error('❌ [Service Access] User account is inactive');
-      return {
-        allowed: false,
-        error: '您的帳號已被停用。請聯絡管理員。',
-      };
-    }
-    console.log('✅ [Service Access] User account is active');
-
-    // 4. 檢查當前 Service 與儲存使用者專屬 API URL
-    console.log('🔄 [Service Access] Step 4/4: Service validation...');
-    const currentHostname = window.location.hostname;
-
-    // 🎯 正確的域名格式判斷：
-    // 統一前端: j.cameo.tw (Load Balancer) 或 botrun-j-{revision}.asia-northeast1.run.app (東京)
-    // 個人後端: j.cameo.tw/u/{hash}/ (Load Balancer) 或 botrun-j-{hash}-{revision}.asia-east1.run.app (台灣)
-
-    const pathname = window.location.pathname;
-    const isUnifiedFrontend =
-      currentHostname === 'j.cameo.tw' && !pathname.startsWith('/u/') ||  // Load Balancer 統一前端
-      currentHostname.includes('.asia-northeast1.run.app') ||              // 舊的 Cloud Run 統一前端
-      currentHostname === 'localhost';                                     // 開發環境
-
-    // 提取 service hash (8位16進制) - 只在個人後端有效
-    let currentServiceHash: string | null = null;
-
-    if (currentHostname === 'j.cameo.tw') {
-      // Load Balancer URL: j.cameo.tw/u/{hash}/
-      const pathnameHashMatch = pathname.match(/^\/u\/([0-9a-f]{8})/);
-      currentServiceHash = pathnameHashMatch ? pathnameHashMatch[1] : null;
-    } else {
-      // 舊的 Cloud Run URL: botrun-j-{hash}-{revision}.asia-east1.run.app
-      const hostnameHashMatch = currentHostname.match(/botrun-j-([0-9a-f]{8})-\d+\.asia-east1\.run\.app/);
-      currentServiceHash = hostnameHashMatch ? hostnameHashMatch[1] : null;
-    }
-
-    const allowedServiceHash = userData.bucketHash;
-
-    console.log('🔍 [Service Access] Service info:');
-    console.log(`   Current hostname: ${currentHostname}`);
-    console.log(`   Is unified frontend: ${isUnifiedFrontend}`);
-    console.log(`   Current hash: ${currentServiceHash || '(統一前端)'}`);
-    console.log(`   User's allowed service: ${userData.allowedService}`);
-    console.log(`   User's service URL: ${userData.serviceUrl}`);
-    console.log(`   User's bucket hash: ${allowedServiceHash}`);
-
-    // 📌 新架構：統一前端作為登入入口，登入後重定向到個人後端
-    // userData.serviceUrl 用於重定向目標
-    if (isUnifiedFrontend) {
-      console.log('✅ [Service Access] 統一前端 - 允許登入');
-      console.log('📍 [Service Access] 使用者將重定向到: ' + userData.serviceUrl);
-      // 允許登入，userData 包含 serviceUrl 供重定向使用
-      return {
-        allowed: true,
-        userData,  // 包含 serviceUrl，AuthContext 會用來重定向
-      };
-    }
-
-    // 如果使用者直接訪問專屬服務 URL，檢查 hash 是否匹配
-    if (currentServiceHash !== allowedServiceHash) {
-      console.warn('⚠️ [Service Access] 訪問了其他使用者的專屬服務');
-      return {
-        allowed: false,
-        userData,
-        error: `您的帳號授權使用 ${userData.allowedService}，請使用主服務登入。`,
-      };
-    }
-    console.log('✅ [Service Access] 訪問自己的專屬服務（允許）');
-
-    // 5. 所有檢查通過
-    console.log('✅ [Service Access] ALL CHECKS PASSED');
-    return {
-      allowed: true,
-      userData,
-    };
-  } catch (error) {
-    console.error('❌ [Service Access] Error checking service access:', error);
-    console.error('📍 [Service Access] Error details:', JSON.stringify(error, null, 2));
-    return {
-      allowed: false,
-      error: '系統錯誤，請稍後再試。',
-    };
-  }
-}
-
-/**
- * 檢查 Firebase Token 中的 Custom Claims
- */
-export async function checkCustomClaims(user: User): Promise<{
-  valid: boolean;
-  allowedService?: string;
-  error?: string;
-}> {
-  try {
-    console.log('🔄 [Custom Claims] Starting custom claims check for:', user.email);
-    console.log('⏱️ [Custom Claims] Fetching ID token result...');
-
-    const tokenResult = await user.getIdTokenResult();
-    const claims = tokenResult.claims;
-
-    console.log(`✅ [Custom Claims] Token retrieved`);
-    console.log('📋 [Custom Claims] Claims:', claims);
-
-    // 檢查是否有 allowedService claim
-    if (!claims.allowedService) {
-      console.warn('⚠️ [Custom Claims] No allowedService claim (might be a new user)');
-      return {
-        valid: false,
-        error: '您的帳號尚未完成設定。請登出後重新登入，或聯絡管理員。',
-      };
-    }
-
-    // 檢查當前服務是否符合
-    const currentHostname = window.location.hostname;
-
-    // 🎯 正確的域名格式判斷：
-    // 統一前端: j.cameo.tw (Load Balancer) 或 botrun-j-{revision}.asia-northeast1.run.app (東京)
-    // 個人後端: j.cameo.tw/u/{hash}/ (Load Balancer) 或 botrun-j-{hash}-{revision}.asia-east1.run.app (台灣)
-
-    // 判斷是否為統一前端
-    const pathname = window.location.pathname;
-    const isUnifiedFrontend =
-      currentHostname === 'j.cameo.tw' && !pathname.startsWith('/u/') ||  // Load Balancer 統一前端
-      currentHostname.includes('.asia-northeast1.run.app') ||              // 舊的 Cloud Run 統一前端
-      currentHostname === 'localhost';                                     // 開發環境
-
-    // 提取 service hash (8位16進制) - 只在個人後端有效
-    let currentServiceHash: string | null = null;
-
-    if (currentHostname === 'j.cameo.tw') {
-      // Load Balancer URL: j.cameo.tw/u/{hash}/
-      const pathnameHashMatch = pathname.match(/^\/u\/([0-9a-f]{8})/);
-      currentServiceHash = pathnameHashMatch ? pathnameHashMatch[1] : null;
-    } else {
-      // 舊的 Cloud Run URL: botrun-j-{hash}-{revision}.asia-east1.run.app
-      const hostnameHashMatch = currentHostname.match(/botrun-j-([0-9a-f]{8})-\d+\.asia-east1\.run\.app/);
-      currentServiceHash = hostnameHashMatch ? hostnameHashMatch[1] : null;
-    }
-
-    const currentService = currentServiceHash ? `botrun-j-${currentServiceHash}` : null;
-
-    console.log('🔍 [Custom Claims] Service check:');
-    console.log('   Current hostname:', currentHostname);
-    console.log('   Is unified frontend:', isUnifiedFrontend);
-    console.log('   Extracted hash:', currentServiceHash || '(none)');
-    console.log('   Current service:', currentService || '(統一前端)');
-    console.log('   Allowed service:', claims.allowedService);
-
-    // 📌 新架構：統一前端作為登入入口，允許所有使用者登入
-    if (isUnifiedFrontend) {
-      console.log('✅ [Custom Claims] 統一前端 - 允許登入，準備重定向');
-      console.log('📍 [Custom Claims] 使用者應前往: ' + claims.allowedService);
-      return {
-        valid: true,
-        allowedService: claims.allowedService as string,
-      };
-    }
-
-    // 如果使用者直接訪問專屬服務，檢查是否匹配
-    if (claims.allowedService !== currentService) {
-      console.error('❌ [Custom Claims] 訪問了其他使用者的專屬服務');
-      return {
-        valid: false,
-        allowedService: claims.allowedService as string,
-        error: `您的帳號授權使用 ${claims.allowedService}，請使用主服務登入。`,
-      };
-    }
-
-    console.log('✅ [Custom Claims] All checks passed');
-    return {
-      valid: true,
-      allowedService: claims.allowedService as string,
-    };
-  } catch (error) {
-    console.error('❌ [Custom Claims] Error checking custom claims:', error);
-    console.error('📍 [Custom Claims] Error details:', JSON.stringify(error, null, 2));
-    return {
-      valid: false,
-      error: '無法驗證您的權限。請重新登入。',
-    };
-  }
-}