From 8823597f4cd0acd0b131574cd47703544b649923 Mon Sep 17 00:00:00 2001
From: Jesse_Chen <chen.yue@mevixaga.com>
Date: Mon, 10 Aug 2026 05:27:24 +0800
Subject: [PATCH] ops: accept direct host isolation during internal verify

---
 deploy/run-production-deploy.sh                  | 5 +++--
 frontend/tests/staging-backend-workflows.test.ts | 3 +++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/deploy/run-production-deploy.sh b/deploy/run-production-deploy.sh
index 6d880d08..610e4444 100755
--- a/deploy/run-production-deploy.sh
+++ b/deploy/run-production-deploy.sh
@@ -241,6 +241,7 @@ for (const [role, key] of [
 }
 
 const internal = process.env.VERIFICATION_MODE === "internal";
+const expectedUserAdminStatus = internal ? 403 : 404;
 const request = (origin, path, options = {}) => {
   if (!internal) return fetch(`${origin}${path}`, options);
   return new Promise((resolve, reject) => {
@@ -298,8 +299,8 @@ for (let attempt = 1; attempt <= 12; attempt += 1) {
     };
     if (
       login.ok
-      && userAdminPage.status === 404
-      && userAdminApi.status === 404
+      && userAdminPage.status === expectedUserAdminStatus
+      && userAdminApi.status === expectedUserAdminStatus
       && adminPage.status === 307
       && adminPage.headers.get("location") === "/login"
       && adminApi.status === 401
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index c986d9c1..43e44fca 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -990,6 +990,9 @@ test("production runner validates state and migrations before switching exact im
   assert.match(runner, /if \[ "\$VERIFICATION_MODE" = "public" \]/);
   assert.match(runner, /import http from "node:http"/);
   assert.match(runner, /http\.request\(\{[\s\S]*Host: new URL\(origin\)\.host/);
+  assert.match(runner, /expectedUserAdminStatus = internal \? 403 : 404/);
+  assert.match(runner, /userAdminPage\.status === expectedUserAdminStatus/);
+  assert.match(runner, /userAdminApi\.status === expectedUserAdminStatus/);
   assert.match(runner, /up -d --no-build api web/);
   assert.match(runner, /up -d --no-build --force-recreate --no-deps caddy/);
   assert.match(runner, /\["identity", "IDENTITY_DATABASE_URL"\]/);