Fix production demo auth and deployment layout

Dockerfile

@@ -25,18 +25,16 @@ COPY packages/db/drizzle.config.ts packages/db/drizzle.config.ts
 COPY apps/api/tsconfig.json apps/api/tsconfig.json
 COPY apps/worker/tsconfig.json apps/worker/tsconfig.json
 
-RUN pnpm --filter @courtmitra/api deploy --prod --legacy /deploy
-COPY apps/api/tsconfig.json /deploy/tsconfig.json
-
-RUN rm -rf /deploy/node_modules/.pnpm/next@* /deploy/node_modules/.pnpm/@next+* /deploy/node_modules/.pnpm/typescript@* /deploy/node_modules/.pnpm/caniuse-lite@* /deploy/node_modules/.pnpm/react@* /deploy/node_modules/.pnpm/react-dom@* /deploy/node_modules/.pnpm/web-streams-polyfill@*
+RUN pnpm prune --prod
 
 FROM node:23-alpine AS runner
 RUN apk add --no-cache tini curl
 WORKDIR /app
-COPY --from=builder /deploy ./
+RUN corepack enable && corepack prepare pnpm@10 --activate
+COPY --from=builder /app ./
 
 EXPOSE 7860
 ENV API_PORT=7860 PORT=7860
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD curl -f http://localhost:7860/api/admin/health || exit 1
 ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["npx", "tsx", "--tsconfig", "tsconfig.json", "src/main.ts"]
+CMD ["pnpm", "--filter", "@courtmitra/api", "start:prod"]

apps/api/src/auth/clerk-auth.guard.ts

@@ -3,6 +3,7 @@ import { Reflector } from "@nestjs/core";
 import { verifyToken } from "@clerk/clerk-sdk-node";
 import { AuthService } from "./auth.service.js";
 import { IS_PUBLIC_KEY } from "./public.decorator.js";
+import { DEMO_CLERK_USER_ID, DEMO_USER_ID } from "./demo-user.js";
 
 @Injectable()
 export class ClerkAuthGuard implements CanActivate {
@@ -30,8 +31,8 @@ export class ClerkAuthGuard implements CanActivate {
       // Demo mode fallback — allow through with a demo user context
       // This lets local dev work without Clerk keys
       if (process.env.DEMO_MODE === "true") {
-        (request as any).clerkUserId = "demo";
-        (request as any).userId = "demo";
+        (request as any).clerkUserId = DEMO_CLERK_USER_ID;
+        (request as any).userId = DEMO_USER_ID;
         return true;
       }
       throw new UnauthorizedException("Missing Authorization header");

apps/api/src/auth/current-user.decorator.ts

@@ -1,4 +1,5 @@
 import { createParamDecorator, ExecutionContext } from "@nestjs/common";
+import { DEMO_USER_ID } from "./demo-user.js";
 
 /**
  * Injects the DB userId from the request (set by ClerkAuthGuard).
@@ -7,6 +8,6 @@ import { createParamDecorator, ExecutionContext } from "@nestjs/common";
 export const CurrentUser = createParamDecorator(
   (_data: unknown, ctx: ExecutionContext): string => {
     const request = ctx.switchToHttp().getRequest<{ userId?: string }>();
-    return request.userId ?? "demo";
+    return request.userId ?? DEMO_USER_ID;
   }
 );

apps/api/src/auth/demo-user.ts

@@ -0,0 +1,3 @@
+export const DEMO_USER_ID = "00000000-0000-0000-0000-000000000001";
+export const DEMO_CLERK_USER_ID = "demo";
+

apps/api/src/main.ts

@@ -6,6 +6,21 @@ import { serve } from "inngest/node";
 import { inngest as workerInngest, functions } from "@courtmitra/worker";
 import { getCapabilities } from "@courtmitra/adapters";
 import { MissionsService } from "./missions/missions.service.js";
+import { schema, type Database } from "@courtmitra/db";
+import { DB } from "./db/db.module.js";
+import { DEMO_CLERK_USER_ID, DEMO_USER_ID } from "./auth/demo-user.js";
+
+async function ensureDemoUser(db: Database) {
+  await db
+    .insert(schema.users)
+    .values({
+      id: DEMO_USER_ID,
+      displayName: "Demo User",
+      email: "demo@courtmitra.local",
+      fullName: "Demo User",
+    })
+    .onConflictDoNothing();
+}
 
 async function bootstrap() {
   const app = await NestFactory.create<NestFastifyApplication>(AppModule, new FastifyAdapter(), {
@@ -17,9 +32,11 @@ async function bootstrap() {
   const fastify = app.getHttpAdapter().getInstance();
 
   if (process.env.DEMO_MODE === "true") {
+    await ensureDemoUser(app.get<Database>(DB));
+
     fastify.addHook("onRequest", async (req: any) => {
-      req.userId = "demo-user-id";
-      req.clerkUserId = "demo";
+      req.userId = DEMO_USER_ID;
+      req.clerkUserId = DEMO_CLERK_USER_ID;
     });
   }
 
@@ -29,7 +46,7 @@ async function bootstrap() {
   const missions = app.get(MissionsService);
   fastify.get("/api/diag/missions", async () => {
     try {
-      const result = await missions.list("demo-user-id");
+      const result = await missions.list(DEMO_USER_ID);
       return { ok: true, count: result.length };
     } catch (e: any) {
       return { ok: false, message: e.message, cause: e.cause?.message || e.cause?.code };

apps/web/middleware.ts

@@ -1,30 +0,0 @@
-import { clerkMiddleware, createRouteMatcher } from "@clerk/nextjs/server";
-import createMiddleware from "next-intl/middleware";
-import { routing } from "./src/i18n/routing";
-
-const intlMiddleware = createMiddleware(routing);
-
-const isProtectedRoute = createRouteMatcher([
-  "/:locale/ledger",
-  "/:locale/missions(.*)",
-  "/:locale/profile",
-]);
-
-export default clerkMiddleware(async (auth, req) => {
-  // Protect specific routes
-  if (isProtectedRoute(req)) {
-    await auth.protect();
-  }
-
-  // Always run next-intl middleware for locale handling
-  return intlMiddleware(req);
-});
-
-export const config = {
-  matcher: [
-    // Skip Next.js internals and all static files
-    "/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)",
-    // Always run for API routes
-    "/(api|trpc)(.*)",
-  ],
-};

apps/web/src/middleware.ts

@@ -1,12 +1,28 @@
+import { clerkMiddleware, createRouteMatcher } from "@clerk/nextjs/server";
 import createMiddleware from "next-intl/middleware";
 import { routing } from "./i18n/routing";
 
-export default createMiddleware(routing);
+const intlMiddleware = createMiddleware(routing);
+
+const isProtectedRoute = createRouteMatcher([
+  "/:locale/ledger",
+  "/:locale/missions(.*)",
+  "/:locale/profile",
+]);
+
+export default clerkMiddleware(async (auth, req) => {
+  if (isProtectedRoute(req)) {
+    await auth.protect();
+  }
+
+  return intlMiddleware(req);
+});
 
 export const config = {
-  // Match all pathnames except:
-  // - API routes (/api/*)
-  // - Next.js internals (/_next/*, /_vercel/*)
-  // - Static files (anything containing a dot)
-  matcher: "/((?!api|_next|_vercel|.*\\..*).*)",
+  matcher: [
+    // Skip Next.js internals and static files, but keep app routes under
+    // Clerk + next-intl middleware.
+    "/((?!_next|_vercel|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)",
+    "/(api|trpc)(.*)",
+  ],
 };