📌 Description
Both sitemap() (src/app/sitemap.ts) and robots() (src/app/robots.ts) compute const baseUrl = process.env.NEXT_PUBLIC_SITE_URL || 'http://localhost:3000'; with no further check. If a production deployment forgets to set NEXT_PUBLIC_SITE_URL (an easy omission — it isn't validated anywhere at build or request time), the live sitemap.xml and robots.txt would silently render every URL and the sitemap: directive pointing at http://localhost:3000, which is useless to search engines and actively wrong in production, with no error, warning, or build failure to surface the misconfiguration.
🧩 Requirements and context
- A missing
NEXT_PUBLIC_SITE_URL in a non-local environment should be surfaced (e.g. a console warning at request time identifying which route emitted it) rather than silently producing a localhost URL with no indication anything is wrong.
- Local development (no
NEXT_PUBLIC_SITE_URL set, e.g. via next dev) must continue to work unchanged, falling back to http://localhost:3000 without requiring the variable to be set.
- The existing route shapes, priorities, and
robots.ts's rules/sitemap fields must be unchanged for the common case where the variable is set correctly.
🛠️ Suggested execution
- In
src/app/sitemap.ts and src/app/robots.ts, detect when NEXT_PUBLIC_SITE_URL is unset while process.env.NODE_ENV === "production" and emit a console.warn (or equivalent) naming the missing variable and the affected route, before falling back to the existing http://localhost:3000 default.
- Extend
src/app/sitemap.test.ts and src/app/robots.test.ts with a case that stubs NODE_ENV to "production" with no NEXT_PUBLIC_SITE_URL set and asserts a warning is logged, plus a case confirming no warning is logged in development.
✅ Acceptance criteria
🔒 Security notes
No new attack surface; a build/deployment-configuration hardening fix that surfaces a misconfiguration instead of silently shipping a broken sitemap/robots file.
📋 Guidelines
- Minimum 95% test coverage
- Clear documentation
- Timeframe: 96 hours
📌 Description
Both
sitemap()(src/app/sitemap.ts) androbots()(src/app/robots.ts) computeconst baseUrl = process.env.NEXT_PUBLIC_SITE_URL || 'http://localhost:3000';with no further check. If a production deployment forgets to setNEXT_PUBLIC_SITE_URL(an easy omission — it isn't validated anywhere at build or request time), the livesitemap.xmlandrobots.txtwould silently render every URL and thesitemap:directive pointing athttp://localhost:3000, which is useless to search engines and actively wrong in production, with no error, warning, or build failure to surface the misconfiguration.🧩 Requirements and context
NEXT_PUBLIC_SITE_URLin a non-local environment should be surfaced (e.g. a console warning at request time identifying which route emitted it) rather than silently producing alocalhostURL with no indication anything is wrong.NEXT_PUBLIC_SITE_URLset, e.g. vianext dev) must continue to work unchanged, falling back tohttp://localhost:3000without requiring the variable to be set.robots.ts'srules/sitemapfields must be unchanged for the common case where the variable is set correctly.🛠️ Suggested execution
src/app/sitemap.tsandsrc/app/robots.ts, detect whenNEXT_PUBLIC_SITE_URLis unset whileprocess.env.NODE_ENV === "production"and emit aconsole.warn(or equivalent) naming the missing variable and the affected route, before falling back to the existinghttp://localhost:3000default.src/app/sitemap.test.tsandsrc/app/robots.test.tswith a case that stubsNODE_ENVto"production"with noNEXT_PUBLIC_SITE_URLset and asserts a warning is logged, plus a case confirming no warning is logged in development.✅ Acceptance criteria
NEXT_PUBLIC_SITE_URLin production logs a clear warning identifying the affected route.localhostfallback, no warning) is unchanged.🔒 Security notes
No new attack surface; a build/deployment-configuration hardening fix that surfaces a misconfiguration instead of silently shipping a broken sitemap/robots file.
📋 Guidelines