From 0a90d46f0f63a3c0f643201aed39313d174dcf9d Mon Sep 17 00:00:00 2001
From: Vorflux AI <249966464+vorflux[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 23:54:33 +0000
Subject: [PATCH] fix(web): validate plugin auth routes before login

---
 apps/web/middleware.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts
index 89587227..b26af882 100644
--- a/apps/web/middleware.ts
+++ b/apps/web/middleware.ts
@@ -34,8 +34,15 @@ export default async function proxy(request: Request) {
 	const sessionCookie = getAuthSessionCookie(request)
 	console.debug("[PROXY] Session cookie exists:", !!sessionCookie)
 
-	// Always allow access to login and waitlist pages
-	const publicPaths = ["/login", "/login/new"]
+	// Always allow access to login and auth connection pages
+	const publicPaths = [
+		"/login",
+		"/login/new",
+		"/auth/connect",
+		"/auth/connect/",
+		"/auth/agent-connect",
+		"/auth/agent-connect/",
+	]
 	if (publicPaths.includes(url.pathname)) {
 		console.debug("[PROXY] Public path, allowing access")
 		return NextResponse.next()