feat: remove strict login requirement

Author: apsinghdev

apps/web/src/lib/auth/protected-routes.ts

@@ -0,0 +1,15 @@
+/**
+ * Configuration for dashboard routes that require authentication.
+ * 
+ * To add a new protected route, simply add the path to this array.
+ * To remove protection from a route, remove it from this array.
+ * 
+ * Routes are matched using prefix matching, so nested routes under
+ * a protected path will also be protected (e.g., /dashboard/projects/123
+ * is protected if /dashboard/projects is in this array).
+ */
+export const PROTECTED_DASHBOARD_ROUTES = [
+  '/dashboard/projects',
+  '/dashboard/sheet',
+] as const;
+

apps/web/src/middleware.ts

@@ -1,5 +1,6 @@
 import { getToken } from "next-auth/jwt";
 import { NextRequest, NextResponse } from "next/server";
+import { PROTECTED_DASHBOARD_ROUTES } from "@/lib/auth/protected-routes";
 
 export async function middleware(req: NextRequest) {
   const adaptedReq = {
@@ -10,12 +11,18 @@ export async function middleware(req: NextRequest) {
     req: adaptedReq as any,
     secret: process.env.NEXTAUTH_SECRET,
   });
-  const protectedPaths = ["/dashboard"];
-  if (protectedPaths.some((path) => req.nextUrl.pathname.startsWith(path))) {
-    if (!token) {
-      const signInUrl = new URL("/login", req.url);
-      return NextResponse.redirect(signInUrl);
-    }
+  
+  const pathname = req.nextUrl.pathname;
+  
+  const isProtectedRoute = PROTECTED_DASHBOARD_ROUTES.some((path) =>
+    pathname.startsWith(path)
+  );
+  
+  if (isProtectedRoute && !token) {
+    const signInUrl = new URL("/login", req.url);
+    signInUrl.searchParams.set("callbackUrl", pathname);
+    return NextResponse.redirect(signInUrl);
   }
+  
   return NextResponse.next();
 }