From 65b0cf4f0130f420c7fead6ae940e997f678337b Mon Sep 17 00:00:00 2001 From: Dave Date: Mon, 21 Sep 2026 01:59:56 +0200 Subject: [PATCH] feat(middleware): carve out /intake/:path* from auth redirect Phase 8a Task 6. The matcher's exclusion is unchanged; this is the explicit short-circuit so a future matcher edit cannot accidentally lock the public route out. --- src/middleware.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/middleware.ts b/src/middleware.ts index 153cb28..a2244ba 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -15,6 +15,14 @@ import { AUTH_COOKIE } from "@/lib/auth/cookie"; export function middleware(request: NextRequest) { const hasAuth = request.cookies.has(AUTH_COOKIE); + // Public intake links have no session. The token IS the authentication, + // and the route's own checks enforce it. A redirect here would lock every + // visitor out of the wizard, so /intake/:path* is the one path the + // cookie check is allowed to ignore. + if (request.nextUrl.pathname.startsWith("/intake/")) { + return NextResponse.next(); + } + if (!hasAuth) { const url = request.nextUrl.clone(); url.pathname = "/login";