From 7d59070ad612203dd6d4e0691fa20e873a9eefc1 Mon Sep 17 00:00:00 2001
From: Rajarshi Datta <138959719+rajarshidattapy@users.noreply.github.com>
Date: Wed, 19 Aug 2026 18:33:58 +0530
Subject: [PATCH] fix(web): scope the ?view=mcp guest exemption to / (#1553)

---
 apps/web/middleware.ts | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts
index 8febfc81..89587227 100644
--- a/apps/web/middleware.ts
+++ b/apps/web/middleware.ts
@@ -41,13 +41,14 @@ export default async function proxy(request: Request) {
 		return NextResponse.next()
 	}
 
-	// MCP setup page is public — no auth required
-	if (url.searchParams.get("view") === "mcp") {
-		return NextResponse.next()
-	}
-
-	// Integrations index is public in guest mode; actions still require login.
-	if (url.pathname === "/" && url.searchParams.get("view") === "integrations") {
+	// Integrations index and MCP setup are public in guest mode; actions still
+	// require login. The ?view param is only meaningful at "/" (see
+	// lib/view-mode-context, which ignores it elsewhere), so scope it there —
+	// unscoped, ?view=mcp would let any path skip the /api/ gate below.
+	if (
+		url.pathname === "/" &&
+		["integrations", "mcp"].includes(url.searchParams.get("view") ?? "")
+	) {
 		return NextResponse.next()
 	}