From d212452a5dc400801cb04bd6fe59615f1b641bbc Mon Sep 17 00:00:00 2001
From: chahinebrini <chahinebrini@gmail.com>
Date: Wed, 3 Jun 2026 09:46:13 +0200
Subject: [PATCH] fix(magic): bundle mobileconfig template via Nitro
 serverAssets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously read template via process.cwd() + 'ops/mdm/…' — but pm2
runs the bundled output from /root, not the repo root, so the path
resolved to /root/ops/mdm/… (does not exist) → HTTP 500 'Profile
template not found' after Mac registration.

Switch to Nitro's serverAssets (baseName 'mdm', dir '../ops/mdm')
which is bundled at build-time and read via
useStorage('assets:server'). cwd-independent + survives any deploy
layout change.
---
 backend/nitro.config.ts                       |  4 +++
 .../api/magic/profile.mobileconfig.get.ts     | 25 +++++++++----------
 2 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/backend/nitro.config.ts b/backend/nitro.config.ts
index 32e3d52..fdb7f13 100644
--- a/backend/nitro.config.ts
+++ b/backend/nitro.config.ts
@@ -10,6 +10,10 @@ export default defineNitroConfig({
   // Default-publicAssets greift nicht zuverlässig wenn srcDir auf "server" zeigt.
   publicAssets: [{ baseURL: "/", dir: "../public", maxAge: 60 * 60 }],
 
+  // Server-Assets: zur Build-Time eingebundelte Files (mobileconfig-Template etc.).
+  // Lesbar via useStorage('assets:server').getItem('mdm/<file>').
+  serverAssets: [{ baseName: "mdm", dir: "../ops/mdm" }],
+
   // Supabase als external dep — nicht bundlen
   externals: {
     inline: [/^(?!@supabase\/supabase-js)/],
diff --git a/backend/server/api/magic/profile.mobileconfig.get.ts b/backend/server/api/magic/profile.mobileconfig.get.ts
index b5462c3..b790def 100644
--- a/backend/server/api/magic/profile.mobileconfig.get.ts
+++ b/backend/server/api/magic/profile.mobileconfig.get.ts
@@ -1,13 +1,12 @@
 import { randomUUID } from "crypto";
-import { readFile } from "fs/promises";
-import { resolve } from "path";
 import { findMagicDeviceByToken } from "../../db/devices";
 
 /**
  * GET /api/magic/profile.mobileconfig?token=<dnsToken>
  *
  * Generiert personalisiertes DNS-Configuration-Profile für macOS.
- * Template: ops/mdm/rebreak-mac-dns-filter.mobileconfig
+ * Template: ops/mdm/rebreak-mac-dns-filter.mobileconfig (via Nitro serverAssets
+ * unter baseName "mdm" eingebundelt — siehe nitro.config.ts).
  *
  * Ersetzt:
  * - ServerURL: /dns-query → /dns-query/{token}
@@ -36,16 +35,16 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  // Template lesen
-  const templatePath = resolve(
-    process.cwd(),
-    "ops/mdm/rebreak-mac-dns-filter.mobileconfig",
-  );
-  let template: string;
-  try {
-    template = await readFile(templatePath, "utf-8");
-  } catch (err: any) {
-    console.error("[Magic] Failed to read profile template:", err);
+  // Template via Nitro serverAssets lesen (build-time eingebundelt → cwd-unabhängig).
+  const storage = useStorage("assets:server");
+  const template = (await storage.getItem(
+    "mdm/rebreak-mac-dns-filter.mobileconfig",
+  )) as string | null;
+
+  if (!template) {
+    console.error(
+      "[Magic] Profile template missing in serverAssets (mdm/rebreak-mac-dns-filter.mobileconfig)",
+    );
     throw createError({
       statusCode: 500,
       message: "Profile template not found",