HealthLog

tom/HealthLog

0 Fork 0

mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-09 04:50:59 +00:00

Files

T

Marc-André Bombeck 753438a329 fix(auth): the invite landing is public in the client shell too

`/invite/<token>` has been public in `proxy.ts` since v1.17.0 and was never
added to the client-side gate in `auth-shell.tsx`. Next streams the shell
before the landing page's RSC redirect resolves, so the shell classified the
route as protected, `/api/auth/me` answered 401, and `router.replace(
"/auth/login")` won the race — the operator's invite link landed on the sign-in
page it was meant to bypass.

The shell now lists `/invite/`, and lists the `/auth/` family as the prefix the
edge already admits rather than as two individual pages, so a future auth page
cannot inherit the same defect. `PUBLIC_PATHS` is exported from `proxy.ts` so a
new parameterised guard can render the shell at every page prefix the edge lets
through and fail when the two lists drift apart again.

2026-09-11 09:08:07 +02:00

__tests__

fix(auth): the invite landing is public in the client shell too

2026-09-11 09:08:07 +02:00

account-switcher-menu.tsx

fix(nav): drop the access-level line from a record-switcher entry

2026-08-08 15:17:05 +02:00

auth-shell.tsx

fix(auth): the invite landing is public in the client shell too

2026-09-11 09:08:07 +02:00

bottom-nav.tsx

fix(sharing): show a guardian the controls the routes accept (#939 )