Molecule AI · fullstack-engineer created pull request molecule-ai/molecule-core#143

Molecule AI · fullstack-engineer
Sat, 09 May 2026 00:16:54 +0000

143#fix(canvas): boot-time matched-pair guard for ADMIN_TOKEN env vars (#53)#

Summary

Adds checkAdminTokenPair() to canvas/next.config.ts to warn at boot when ADMIN_TOKEN and NEXT_PUBLIC_ADMIN_TOKEN are not both set or both unset. Warns via console.error (recoverable — does not process.exit) so the message surfaces in next dev console, standalone server stdout, and Docker container logs.

Fixes the post-PR-#174 self-review gap: asymmetric configuration (one set, one unset) silently 401s against workspace-server.

Changes

canvas/next.config.ts: +checkAdminTokenPair() called after loadMonorepoEnv()

canvas/src/lib/tests/admin-token-pair.test.ts: 8 tests covering all asymmetry combos

Test plan

8/8 admin-token-pair tests pass (3ms)

platform-auth-headers tests pass (6/6)

bash -n clean on next.config.ts

Closes #53

Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com