fix(auth): redirect unauthenticated deep links to home, not /login #11
Reference in New Issue
Block a user
Delete Branch "fix/auth-guard-redirect-home"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Unauthenticated visitors hitting a protected URL directly were sent to /login instead of the home page. Fix: Shell redirects to / (still carrying state.from), LandingPage forwards that state through its Sign in CTAs to /login so the deep-link intent survives the bounce. New test covers the from-state handoff. 25 suites / 56 tests green.
Shell (the single auth guard wrapping every protected route under /*) redirected unauthenticated visitors straight to /login instead of the home page, contrary to the intended behaviour. Root cause was one line in App.tsx's Shell render gate. Everything else in the guard was already correct: a single centralized check (no per-page duplication), a loading gate that blocks render until /auth/config + /auth/me resolve (no flicker-redirect), and 401-triggered re-checks via the axios interceptor + auth-changed event for expired sessions mid-session. Fix: - Shell now redirects to "/" (home) instead of "/login", still passing state={{ from: path }} so the originally-requested page isn't lost. - LandingPage forwards that location.state through to /login on every "Sign in" CTA (6 call sites collapsed into one goToLogin() helper), so the home-page bounce doesn't drop the deep-link intent — sign-in still returns the user to the page they wanted instead of dropping them on the default /jobs. - Added LandingPage.authRedirect.test.tsx covering the from-state handoff end to end (Landing -> click Sign in -> /login receives from). Full suite: 25 suites, 56 tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>