auth

apps/website/middleware.ts

@@ -3,14 +3,13 @@ import type { NextRequest } from 'next/server';
 import { getAppMode, isPublicRoute } from './lib/mode';
 
 /**
- * Next.js middleware for route protection based on application mode
+ * Next.js middleware for route protection
  *
- * In pre-launch mode:
- * - Only allows access to public routes (/, /api/signup)
- * - Returns 404 for all other routes
- *
- * In alpha mode:
- * - All routes are accessible
+ * Features:
+ * - Public routes are always accessible
+ * - Protected routes require authentication
+ * - Demo mode allows access to all routes
+ * - Returns 401 for unauthenticated access to protected routes
  */
 export function middleware(request: NextRequest) {
   const mode = getAppMode();
@@ -20,18 +19,39 @@ export function middleware(request: NextRequest) {
   if (pathname === '/404' || pathname === '/500' || pathname === '/_error') {
     return NextResponse.next();
   }
-  
-  // In alpha mode, allow all routes
-  if (mode === 'alpha') {
+
+  // Always allow static assets and API routes (API handles its own auth)
+  if (
+    pathname.startsWith('/_next/') ||
+    pathname.startsWith('/api/') ||
+    pathname.match(/\.(svg|png|jpg|jpeg|gif|webp|ico|css|js)$/)
+  ) {
     return NextResponse.next();
   }
-  
-  // In pre-launch mode, check if route is public
+
+  // Public routes are always accessible
   if (isPublicRoute(pathname)) {
     return NextResponse.next();
   }
-  
-  // Protected route in pre-launch mode - return 404
+
+  // Check for authentication cookie
+  const cookies = request.cookies;
+  const hasAuthCookie = cookies.has('gp_session');
+
+  // In demo/alpha mode, allow access if session cookie exists
+  if (mode === 'alpha' && hasAuthCookie) {
+    return NextResponse.next();
+  }
+
+  // In demo/alpha mode without auth, redirect to login
+  if (mode === 'alpha' && !hasAuthCookie) {
+    const loginUrl = new URL('/auth/login', request.url);
+    loginUrl.searchParams.set('returnTo', pathname);
+    return NextResponse.redirect(loginUrl);
+  }
+
+  // In pre-launch mode, only public routes are accessible
+  // Protected routes return 404 (non-disclosure)
   return new NextResponse(null, {
     status: 404,
     statusText: 'Not Found',