Restore sign-in redirect for signed-out dashboard requests

[brijr]

Summary

Signed-out visitors to app.router.so were seeing the 404 page instead of the login page after #45.

next-auth only performs its automatic redirect to the sign-in page when auth() is used without a custom middleware function. #45 wrapped the middleware to rewrite the forms.router.so host, which silently disabled that redirect, so signed-out requests reached dashboard pages whose data actions failed and rendered not-found. Signed-in sessions were unaffected.

The authorized callback now returns the redirect itself, which next-auth honours ahead of the middleware function. The decision lives in lib/auth/authorize.ts with a unit test covering the redirect, the sign-in page, signed-in requests, and public form surfaces.

Verification

• pnpm typecheck, pnpm lint, pnpm test:unit (160 passed, 4 new)
• Local dev server: / and /endpoints return 307 to /login?callbackUrl=... when signed out; /login, /f/*, and /embed/v1.js still return 200.

🤖 Generated with Claude Code

https://claude.ai/code/session_011hhKHKm5i7XvzjVpTbjQ5T

Summary by CodeRabbit

• Access Control

  • Unauthenticated dashboard visitors are redirected to the sign-in page.
  • The original destination, including its query parameters, is preserved for return after signing in.
  • Signed-in users and the sign-in page remain accessible.

• Public Access

  • Public form pages, embedded forms, public form APIs, WordPress integration endpoints, and the forms.router.so host remain available without signing in.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
router	Ready	Preview	Sep 11, 2026 7:20pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 49efa5fe-467a-4ff8-9a42-3bb50a9b86cd

📥 Commits

Reviewing files that changed from the base of the PR and between 9ea217a and c12a64b.

📒 Files selected for processing (3)

• __tests__/authorize.test.ts
• lib/auth/authorize.ts
• lib/auth/index.ts

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds a reusable authorization helper, delegates the NextAuth authorization callback to it, and adds tests for redirects, authenticated requests, the sign-in path, and public form surfaces.

Changes

Authorization flow

Layer / File(s)	Summary
Authorization helper lib/auth/authorize.ts	Adds public form surface detection and redirects unauthenticated private requests to /login with the original URL as callbackUrl.
Callback integration and validation lib/auth/index.ts, __tests__/authorize.test.ts	Routes the NextAuth authorized callback through authorizeRequest. Tests cover redirect status, callback preservation, authenticated access, the sign-in path, public paths, and the forms.router.so host.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant NextAuthAuthorizedCallback
  participant authorizeRequest
  participant NextResponse
  NextAuthAuthorizedCallback->>authorizeRequest: pass authenticated and nextUrl
  authorizeRequest->>NextResponse: return true or a 307 login redirect

Loading

Merge Risk: ⚪ Minimal · up to c12a6

Signed-out dashboard requests redirect to login while public form surfaces and authenticated requests remain accessible. No actionable current-head risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: restoring sign-in redirects for unauthenticated dashboard requests.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brijr/fix-signed-out-redirect

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

__tests__/authorize.test.ts

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

lib/auth/authorize.ts

ESLint skipped: the matched ESLint configuration already failed (missing-dependency).

lib/auth/index.ts

ESLint skipped: the matched ESLint configuration already failed (missing-dependency).

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}