fix(web): validate plugin auth routes before login

This commit is contained in:
Vorflux AI 2026-08-28 23:54:33 +00:00
parent 8f063bd2ae
commit 0a90d46f0f

View file

@ -34,8 +34,15 @@ export default async function proxy(request: Request) {
const sessionCookie = getAuthSessionCookie(request)
console.debug("[PROXY] Session cookie exists:", !!sessionCookie)
// Always allow access to login and waitlist pages
const publicPaths = ["/login", "/login/new"]
// Always allow access to login and auth connection pages
const publicPaths = [
"/login",
"/login/new",
"/auth/connect",
"/auth/connect/",
"/auth/agent-connect",
"/auth/agent-connect/",
]
if (publicPaths.includes(url.pathname)) {
console.debug("[PROXY] Public path, allowing access")
return NextResponse.next()