Require authentication on API routes; upgrade Next.js (#16)

API routes now check the caller in middleware and again in each route
handler. AUTH_MODE controls the check:

- unset: anonymous access only under `next dev`; production builds
  return 401
- easyauth: requires the principal header set by Azure Container Apps
  built-in authentication
- anonymous: no check

Unknown values are rejected.

Upgrade next and eslint-config-next to 15.5.25 and update the config
for Next.js 15 (top-level output file tracing options, ES2017 target,
async route params). Keep .env*.local and .azure out of the Docker
build context. Document how to turn on sign-in for a deployment.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: manekinekko

.dockerignore

@@ -5,4 +5,6 @@ npm-debug.log
 README.md
 .next
 docker
-.git
+.git
+.env*.local
+.azure

README.md

@@ -45,6 +45,8 @@ This template, the application code and configuration it contains, has been buil
   - [Local environment](#local-environment)
 - [Deploying](#deploying)
   - [Deploying again](#deploying-again)
+- [Authentication](#authentication)
+  - [Turn on sign-in for your deployment](#turn-on-sign-in-for-your-deployment)
 - [Running the development server](#running-the-development-server)
   - [Using Docker (optional)](#using-docker-optional)
 - [Running application at no cost](#running-application-at-no-cost)
@@ -204,6 +206,33 @@ If you've changed the infrastructure files ([`infra`](./infra/) folder or [`azur
 azd up
 ```
 
+## Authentication
+
+Every API route (`/api/chat`, `/api/chat/upload`, `/api/chat/config`, `/api/chat/config/llamacloud`, `/api/files/*`) checks the caller before it reads files, touches the index, or calls Azure OpenAI. The `AUTH_MODE` environment variable controls the check:
+
+| `AUTH_MODE` | Behavior |
+| ----------- | -------- |
+| _unset_     | `npm run dev` allows anonymous access so local development keeps working. `npm start` and the container image reject every API request with `401`. |
+| `easyauth`  | Requires the `X-MS-CLIENT-PRINCIPAL-ID` header that [Azure Container Apps built-in authentication](https://learn.microsoft.com/azure/container-apps/authentication) sets for signed-in users. Only set this when built-in authentication is enabled and requires sign-in. Container Apps strips that header from client requests only when built-in authentication is on. |
+| `anonymous` | No authentication. Don't use this on a public endpoint. It's only for local testing or when another gateway authenticates every request. |
+
+### Turn on sign-in for your deployment
+
+A fresh `azd up` deploys an app whose API returns `401` until you turn on sign-in:
+
+1. In the Azure portal, open the container app in the `rg-<env-name>` resource group.
+2. Go to **Settings > Authentication > Add identity provider**, pick **Microsoft**, and let it create a new app registration. Keep **Require authentication** and **HTTP 302 Found redirect**.
+3. Tell the app to trust the signed-in user headers:
+
+   ```shell
+   az containerapp list --resource-group rg-<env-name> --query "[].name" -o tsv
+   az containerapp update --name <container-app-name> --resource-group rg-<env-name> --set-env-vars AUTH_MODE=easyauth
+   ```
+
+`azd provision` and `azd up` reset the container's environment variables, so run step 3 again after either one. The authentication settings from step 2 stay in place.
+
+Set `AUTH_MODE` on the container app, not in `.env`. The deployment copies `.env` into the container image, so an `AUTH_MODE` line there applies in Azure whenever the container app doesn't set its own value. To run the container locally, pass `-e AUTH_MODE=anonymous` to `docker run`.
+
 ## Running the development server
 
 You can run a development server locally **after** having successfully run the `azd up` (or simply `azd provision`) command. If you haven't yet, follow the [deploying](#deploying) steps above.

app/api/auth.ts

@@ -0,0 +1,77 @@
+import { NextResponse } from "next/server";
+
+/**
+ * Inbound authentication gate for every API route.
+ *
+ * AUTH_MODE controls how callers are authenticated:
+ * - "easyauth": Azure Container Apps built-in authentication (EasyAuth) is
+ *   enabled in front of the app. Requests must carry the
+ *   X-MS-CLIENT-PRINCIPAL-ID header, which the platform sets for signed-in
+ *   callers and strips from any client-supplied request.
+ * - "anonymous": no authentication. Only use this for local development or
+ *   when another trusted gateway authenticates every request.
+ *
+ * When AUTH_MODE is unset, a development build (`next dev`) allows anonymous
+ * access for local development, while a production build (`next start`, the
+ * container image) fails closed and rejects every API request. Unknown values
+ * also fail closed.
+ */
+export type AuthMode = "easyauth" | "anonymous" | "unconfigured";
+
+const PRINCIPAL_ID_HEADER = "x-ms-client-principal-id";
+
+// `next build` inlines NODE_ENV, so a production build can't be switched back
+// to the anonymous development fallback by setting NODE_ENV at runtime.
+const IS_DEV_BUILD = process.env.NODE_ENV === "development";
+
+let warned = false;
+
+export function resolveAuthMode(
+  env: Record<string, string | undefined> = process.env,
+): AuthMode {
+  const mode = env.AUTH_MODE?.trim().toLowerCase();
+  if (mode === "easyauth") return "easyauth";
+  if (mode === "anonymous") return "anonymous";
+  if (!mode && IS_DEV_BUILD) return "anonymous";
+  return "unconfigured";
+}
+
+function warnOnce(message: string) {
+  if (!warned) {
+    warned = true;
+    console.warn(`[auth] ${message}`);
+  }
+}
+
+/**
+ * Returns a 401 response when the request is not authenticated, or null when
+ * the request may proceed.
+ */
+export function checkAuth(headers: Headers): NextResponse | null {
+  const mode = resolveAuthMode();
+
+  if (mode === "anonymous") {
+    if (!IS_DEV_BUILD) {
+      warnOnce(
+        "AUTH_MODE=anonymous: API routes are reachable without authentication.",
+      );
+    }
+    return null;
+  }
+
+  if (mode === "easyauth" && headers.get(PRINCIPAL_ID_HEADER)) {
+    return null;
+  }
+
+  if (mode === "unconfigured") {
+    warnOnce(
+      "Rejecting API requests because authentication is not configured. " +
+        "Enable Azure Container Apps authentication and set AUTH_MODE=easyauth.",
+    );
+  }
+
+  return NextResponse.json(
+    { error: "Unauthorized" },
+    { status: 401, headers: { "Cache-Control": "no-store" } },
+  );
+}

app/api/chat/config/llamacloud/route.ts

@@ -1,10 +1,14 @@
 import { LLamaCloudFileService } from "llamaindex";
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
+import { checkAuth } from "../../../auth";
 
 /**
  * This API is to get config from the backend envs and expose them to the frontend
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
+  const denied = checkAuth(request.headers);
+  if (denied) return denied;
+
   if (!process.env.LLAMA_CLOUD_API_KEY) {
     return NextResponse.json(
       {

app/api/chat/config/route.ts

@@ -1,9 +1,13 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
+import { checkAuth } from "../../auth";
 
 /**
  * This API is to get config from the backend envs and expose them to the frontend
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
+  const denied = checkAuth(request.headers);
+  if (denied) return denied;
+
   const config = {
     starterQuestions: process.env.CONVERSATION_STARTERS?.trim().split("\n"),
   };

app/api/chat/route.ts

@@ -2,6 +2,7 @@ import { initObservability } from "@/app/observability";
 import { LlamaIndexAdapter, Message, StreamData } from "ai";
 import { ChatMessage, Settings } from "llamaindex";
 import { NextRequest, NextResponse } from "next/server";
+import { checkAuth } from "../auth";
 import { createChatEngine } from "./engine/chat";
 import { initSettings } from "./engine/settings";
 import {
@@ -24,6 +25,9 @@ async function setVectorStoreInstance() {
 }
 
 export async function POST(request: NextRequest) {
+  const denied = checkAuth(request.headers);
+  if (denied) return denied;
+
   // Init Vercel AI StreamData and timeout
   const vercelStreamData = new StreamData();
 

app/api/chat/upload/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { checkAuth } from "../../auth";
 import { getDataSource } from "../engine";
 import { initSettings } from "../engine/settings";
 import { uploadDocument } from "../llamaindex/documents/upload";
@@ -9,6 +10,9 @@ export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
 export async function POST(request: NextRequest) {
+  const denied = checkAuth(request.headers);
+  if (denied) return denied;
+
   try {
     const {
       name,

app/api/files/[...slug]/route.ts

@@ -1,5 +1,6 @@
 import { readFile } from "fs/promises";
 import { NextRequest, NextResponse } from "next/server";
+import { checkAuth } from "../../auth";
 import path from "path";
 import { DATA_DIR } from "../../chat/engine/loader";
 
@@ -8,10 +9,13 @@ import { DATA_DIR } from "../../chat/engine/loader";
  * It receives path slug and response file data like serve static file
  */
 export async function GET(
-  _request: NextRequest,
-  { params }: { params: { slug: string[] } },
+  request: NextRequest,
+  { params }: { params: Promise<{ slug: string[] }> },
 ) {
-  const slug = params.slug;
+  const denied = checkAuth(request.headers);
+  if (denied) return denied;
+
+  const slug = (await params).slug;
 
   if (!slug) {
     return NextResponse.json({ detail: "Missing file slug" }, { status: 400 });
@@ -21,7 +25,7 @@ export async function GET(
     return NextResponse.json({ detail: "Invalid file path" }, { status: 400 });
   }
 
-  const [folder, ...pathTofile] = params.slug; // data, file.pdf
+  const [folder, ...pathTofile] = slug; // data, file.pdf
   const allowedFolders = ["data", "output"];
 
   if (!allowedFolders.includes(folder)) {

app/components/header.tsx

@@ -1,10 +1,11 @@
 import Image from "next/image";
+import Link from "next/link";
 
 export default function Header() {
   return (
     <div className="z-10 max-w-5xl w-full items-center justify-between font-mono text-sm lg:flex">
       <div className="fixed bottom-0 left-0 mb-4 flex h-auto w-full items-end justify-center bg-gradient-to-t from-white via-white dark:from-black dark:via-black lg:static lg:w-auto lg:bg-none lg:mb-0">
-        <a
+        <Link
           href="/"
           className="flex items-center justify-center font-nunito text-lg font-bold gap-2"
         >
@@ -17,7 +18,7 @@ export default function Header() {
           priority
         />
           <span>LlamaIndex & Azure AI Vector Search</span>
-        </a>
+        </Link>
       </div>
     </div>
   );

middleware.ts

@@ -0,0 +1,12 @@
+import { NextRequest, NextResponse } from "next/server";
+import { checkAuth } from "./app/api/auth";
+
+export function middleware(request: NextRequest) {
+  return checkAuth(request.headers) ?? NextResponse.next();
+}
+
+export const config = {
+  matcher: "/api/:path*",
+  // Node.js runtime so AUTH_MODE is read at runtime, not inlined at build time.
+  runtime: "nodejs",
+};