fix(infra): ALB routing + admin password reset
From the PR description
Summary
Fixes two critical bugs reported in the Manus AI bug report:
Bug 1: Admin Login Broken
- Root cause: Admin password was changed/rotated during a deploy without updating documentation
- Fix: Reset password via GoTrue Admin API using
scripts/reset-admin-password.py - Verification: Login returns valid JWT, profile shows role=admin, status=active
Bug 2: ALB Routing - Pages Going to Backend
- Root cause: Next.js pages (
/projects,/workflows) and Express API routes share the same paths. ALB path-pattern rules routed everything to the backend, returning 401 JSON instead of HTML - Fix: Created 4 ALB listener rules (priority 11-14) with header-based routing. Browser navigation (
Accept: text/html) goes to frontend; API calls (Accept: application/json) fall through to existing backend rules - Verification: All smoke tests pass (see below)
Changes
scripts/reset-admin-password.py- Reusable script to reset admin password via GoTrue Admin APIinfra/alb-listener-rules.md- Documents all current ALB rules including the new header-based routing
Smoke Test Results
| Test | Expected | Actual |
|---|---|---|
| Login with new password | 200 + JWT | ✅ 200, token len=800 |
| GET /user/profile (with token) | 200, role=admin | ✅ admin, active |
| GET /projects (with token) | 200, list | ✅ 0 projects |
| /projects (Accept: text/html) | 200 HTML | ✅ 200 text/html |
| /projects (Accept: application/json) | 401 JSON | ✅ 401 application/json |
| /workflows (Accept: text/html) | 200 HTML | ✅ 200 text/html |
| /workflows (Accept: application/json) | 401 JSON | ✅ 401 application/json |
| /login (Accept: text/html) | 200 HTML | ✅ 200 text/html |
| /health (Accept: application/json) | 200 JSON | ✅ 200 application/json |
| POST /chat (no auth) | 401 JSON | ✅ 401 application/json |
Note
The ALB rules were applied directly via AWS CLI (production is live).
The Terraform in infra/main.tf is out of sync with the actual ALB state
(no HTTPS listener, different target group names). Full Terraform import
and sync is planned for Sprint 6.
Future improvement: move backend API routes under /api/* prefix to
eliminate the path conflict entirely.
Our analysis
Repair admin access and ALB route handling — read the full analysis →
Think the analysis missed something the PR description covers?
Capture this PR into my fork
Download a Markdown prompt that tells Claude how to port every
commit in this PR into your working tree. Run it via
claude -p < capture-pull-19.md from
inside the repo you want the changes in.