Skip to content

Restrict guest access before dashboard #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnthonyM5 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Restrict guest access before dashboard #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 29 additions & 27 deletions middleware.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import { NextResponse } from 'next/server'
const PUBLIC_ROUTES = ['/', '/auth/login', '/auth/sign-up']

// Routes that allow guest access
const GUEST_ALLOWED_ROUTES = ['/dashboard', '/food-details', '/api/foods']
const GUEST_ALLOWED_ROUTES = ['/food-details', '/api/foods']

// Check if Supabase is configured
function isSupabaseConfigured(): boolean {
Expand All @@ -32,8 +32,12 @@ export async function middleware(request: NextRequest) {
path.startsWith(route)
)

if (isGuestMode && isGuestAllowedRoute) {
return response
if (isGuestMode) {
if (isGuestAllowedRoute) {
return response
}

return NextResponse.redirect(new URL('/auth/login', request.url))
Comment on lines +36 to +40
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Guest mode now loops back to login

Removing /dashboard from the guest-allowed list means requests with the guestMode cookie now hit this branch and are redirected to /auth/login. The GuestModeButton still sets that cookie and routes guests to /dashboard, so “Continue as Guest” immediately bounces back to the login page and the guest dashboard experience is unreachable. Consider keeping /dashboard guest-accessible or update the guest entry point/target so the guest flow still lands on an allowed page.

Useful? React with 👍 / 👎.

}

// If Supabase is not configured, handle routes without authentication
Expand All @@ -43,32 +47,30 @@ export async function middleware(request: NextRequest) {
}

// Only create Supabase client and check session if NOT in guest mode
Copy link

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment at line 49 is now inaccurate. After the refactoring, the Supabase client is created regardless of guest mode status. Since guest mode users that reach this point have already been redirected (line 40), the comment should be updated to reflect that this code only executes for non-guest users due to the early return, or the comment should be removed as it's now misleading.

Suggested change
// Only create Supabase client and check session if NOT in guest mode

Copilot uses AI. Check for mistakes.
if (!isGuestMode) {
const supabase = createServerClient<Database>(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
{
cookies: {
get(name: string) {
return request.cookies.get(name)?.value
},
set(name: string, value: string, options: CookieOptions) {
response.cookies.set(name, value, options)
},
remove(name: string, options: CookieOptions) {
response.cookies.set(name, '', { ...options, maxAge: 0 })
},
const supabase = createServerClient<Database>(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
{
cookies: {
get(name: string) {
return request.cookies.get(name)?.value
},
}
)

const {
data: { session },
} = await supabase.auth.getSession()

if (session) {
return response
set(name: string, value: string, options: CookieOptions) {
response.cookies.set(name, value, options)
},
remove(name: string, options: CookieOptions) {
response.cookies.set(name, '', { ...options, maxAge: 0 })
},
},
}
)

const {
data: { session },
} = await supabase.auth.getSession()

if (session) {
return response
}

// Redirect to login for protected routes
Expand Down
Loading