Fix frontend login route cleanup

Author: root

docs/PRD.md

@@ -71,7 +71,7 @@ At the product level, the current version delivers three core values:
 | Route | Page | Notes |
 | --- | --- | --- |
 | `/` | Welcome page | Default entry when no reachable workspace is available; also provides workspace open and settings entry |
-| `/auth` | Auth page | The actual frontend login route |
+| `/login` | Auth page | Frontend login route |
 | `/workspace` | Workspace page | Main workspace; desktop and mobile use different experiences |
 | `/settings` | Settings page | Desktop and mobile share the same capability set, with different navigation structures |
 | `*` | 404 page | Displays unmatched paths and provides a return-home action |
@@ -156,7 +156,7 @@ The main content is a centered welcome card. Mobile only adjusts styling, not th
 - The welcome page itself has no complex error state.
 - If the app has already resolved at least one workspace, the startup flow usually redirects the user to `/workspace`, so the welcome page is not a long-lived state.
 
-## 4.2 Auth Page `/auth`
+## 4.2 Auth Page `/login`
 
 ### 4.2.1 Page Goal
 
@@ -1568,14 +1568,15 @@ This chapter covers only two kinds of content:
 
 ### 8.1 Auth Route Implementation Note
 
-The main product review chapters consistently describe the login page as `/auth`, because that is the actual mounted frontend login page.
+The frontend login page is mounted at `/login`.
 
-But one implementation fact still needs to be preserved:
+Backend auth endpoints remain under `/auth/*`, such as:
 
-- Server-side SPA navigation for unauthenticated users redirects to `/login`
-- Frontend bootstrap actively navigates users to `/auth` when auth fails
+- `/auth/status`
+- `/auth/login`
+- `/auth/logout`
 
-So the product document uses `/auth` in the main body, while preserving `/login` here as an implementation fact on the server side.
+`/auth` is not a frontend page route and should not be described as one in product-facing flow documentation.
 
 ### 8.2 Theme Persistence Boundary
 

docs/PRD.zh-CN.md

@@ -74,7 +74,7 @@ Coder Studio 是一款**面向自部署环境、以 Deploy once, coding everywhe
 | 路由 | 页面 | 说明 |
 | --- | --- | --- |
 | `/` | 欢迎页 | 当没有可进入的 workspace 时作为默认入口；也承接打开工作区与进入设置 |
-| `/auth` | 登录页 | 当前前端实际登录页 |
+| `/login` | 登录页 | 前端登录页路由 |
 | `/workspace` | 工作区页 | 主工作区；桌面与移动端为两套不同体验 |
 | `/settings` | 设置页 | 桌面与移动端共用同一页能力，但导航结构不同 |
 | `*` | 404 页面 | 展示未命中路径并提供返回首页操作 |
@@ -163,7 +163,7 @@ Coder Studio 是一款**面向自部署环境、以 Deploy once, coding everywhe
 
 ---
 
-## 4.2 登录页 `/auth`
+## 4.2 登录页 `/login`
 
 ### 4.2.1 页面目标
 
@@ -1592,14 +1592,15 @@ Supervisor 的编辑类交互由两种容器承载：
 
 ### 8.1 认证路由实现备注
 
-产品评审正文统一把登录页写作 `/auth`，因为这是当前前端实际挂载的登录页面。
+前端登录页挂载在 `/login`。
 
-但实现上还存在一个需要保留的事实：
+后端鉴权接口仍然位于 `/auth/*`，例如：
 
-- 服务端未认证的 SPA 导航会重定向到 `/login`
-- 前端 bootstrap 在鉴权失败时会主动把用户导航到 `/auth`
+- `/auth/status`
+- `/auth/login`
+- `/auth/logout`
 
-因此，产品文档正文以 `/auth` 页面描述登录流，附录保留 `/login` 的服务端实现事实。
+`/auth` 不是前端页面路由，产品流程文档不应再把它描述成登录页。
 
 ### 8.2 Theme 持久化边界
 

docs/superpowers/plans/2026-05-01-mobile-friendly-phase-0.md

@@ -139,13 +139,13 @@ function useWorkspaceBootstrap() {
 
     const authRequired = authEnabled === true;
     if (authRequired && !authenticated) {
-      if (location.pathname !== '/auth') {
-        navigate('/auth', { replace: true });
+      if (location.pathname !== '/login') {
+        navigate('/login', { replace: true });
       }
       return;
     }
 
-    if (location.pathname === '/auth') {
+    if (location.pathname === '/login') {
       navigate('/', { replace: true });
       return;
     }
@@ -234,7 +234,7 @@ export function DesktopShell() {
   const location = useLocation();
   const authRequired = authEnabled === true;
   const authUnknown = authEnabled === null;
-  const shouldShowLogin = authRequired && !authenticated && location.pathname === '/auth';
+  const shouldShowLogin = authRequired && !authenticated && location.pathname === '/login';
   const shouldShowGlobalConfigDriftBanner =
     !shouldShowLogin && !authUnknown && !location.pathname.startsWith('/settings');
 
@@ -265,7 +265,7 @@ export function DesktopShell() {
         ) : (
           <Routes>
             <Route path="/" element={<WelcomePage />} />
-            <Route path="/auth" element={<LoginPage />} />
+            <Route path="/login" element={<LoginPage />} />
             <Route path="/workspace" element={<WorkspacePage />} />
             <Route path="/settings" element={<SettingsPage />} />
           </Routes>
@@ -371,8 +371,8 @@ describe('DesktopShell auth gating', () => {
     expect(screen.getByText('WorkspacePage')).toBeInTheDocument();
   });
 
-  it('renders the explicit /auth route when auth is enabled and user is unauthenticated', () => {
-    window.history.replaceState({}, '', '/auth');
+  it('renders the explicit /login route when auth is enabled and user is unauthenticated', () => {
+    window.history.replaceState({}, '', '/login');
     const store = createStore();
     store.set(connectionStatusAtom, 'connected');
     store.set(authEnabledAtom, true);
@@ -548,7 +548,7 @@ pnpm dev:web
 
 Open the dev URL the script prints. Verify:
 - App loads without console errors
-- Routes (`/`, `/workspace`, `/settings`, `/auth`) render the same as before
+- Routes (`/`, `/workspace`, `/settings`, `/login`) render the same as before
 
 Stop the dev server.
 
@@ -1273,7 +1273,7 @@ In a wide browser window:
 - `/` shows Welcome (or redirects to `/workspace`)
 - `/workspace` renders the workspace shell with all panels visible
 - `/settings` opens settings normally
-- `/auth` (when auth required) renders login
+- `/login` (when auth required) renders login
 - Connection banner appears when WS reconnects
 - Command palette opens via shortcut
 - No console errors

docs/superpowers/plans/2026-05-01-mobile-friendly-phase-1.md

@@ -136,7 +136,7 @@ Use the shared bootstrap hook and keep non-workspace routes on the existing page
 ```tsx
 <Routes>
   <Route path="/" element={<WelcomePage />} />
-  <Route path="/auth" element={<LoginPage />} />
+  <Route path="/login" element={<LoginPage />} />
   <Route path="/settings" element={<SettingsPage />} />
   <Route path="/workspace" element={<MobileWorkspaceScaffold />} />
 </Routes>

docs/superpowers/specs/2026-04-13-coder-studio-design.md

@@ -1751,13 +1751,11 @@ app.register(authPlugin, {
 ```
 
 Plugin 内部：
-- 非白名单路径（`/api/auth/*`、`/healthz`、`/internal/hooks/*`）以外都要有效 cookie
+- 非白名单路径（`/auth/*`、`/healthz`）以外都要有效 cookie
 - WS 连接前 upgrade 阶段也校验 cookie
 - 登录失败 → 记录到 `auth_failures` → 命中阈值 → 写入 `auth_blocked_ips`
 - IP 黑名单提前短路 (`ipBlocker` middleware)
 
-内部 hooks endpoint `/internal/hooks/:event` **不经过** auth，但必须带查询参数 token 且只接受 `127.0.0.1` 连接（server 明确 bind 时也是如此）。
-
 ### 4.13 服务器生命周期与信号处理
 
 **启动流程**已在 §4.0 / §4.1 描述。本节聚焦关闭和异常退出。
@@ -1980,7 +1978,7 @@ main.tsx
 | `/workspace/:id` | `<WorkspacePage workspaceId={id}>` |
 | `/settings` | `<SettingsPage>` |
 | `/settings/:section` | `<SettingsPage section={section}>` |
-| `/auth` | `<AuthPage>` (Phase 2) |
+| `/login` | `<AuthPage>` (Phase 2) |
 
 ### 5.2 Jotai Atom 组织
 

docs/superpowers/specs/2026-04-30-mobile-friendly-design.md

@@ -391,7 +391,7 @@ drawer 永远盖过 sheet，sheet 永远盖过 chat。
 
 ### 9.3 认证 / 会话
 
-- token 过期：拦截 ws 重连失败，自动 navigate 到 `/auth`，登录后回原 path
+- token 过期：拦截 ws 重连失败，自动 navigate 到 `/login`，登录后回原 path
 - 移动端 auth 与桌面共用 atoms，shell 切换无感
 
 ### 9.4 应用前后台切换（移动专属）

docs/superpowers/specs/2026-05-01-mobile-friendly-phase-4a-design.md

@@ -16,7 +16,7 @@ This phase exists because Phase 3 already established the mobile workspace shell
 ## 2. In Scope
 
 - Mobile full-screen treatment for `/` via `WelcomePage`
-- Mobile full-screen treatment for `/auth` via `LoginPage`
+- Mobile full-screen treatment for `/login` via `LoginPage`
 - Mobile full-screen treatment for `/settings` via `SettingsPage`
 - Mobile-only `Settings` navigation stack inside the existing `/settings` route
 - Mobile-safe return behavior from `Settings`
@@ -43,7 +43,7 @@ This phase also does not change:
 
 ## 4. Design Constraints
 
-- Route paths remain unchanged: `/`, `/auth`, `/workspace`, `/settings`
+- Route paths remain unchanged: `/`, `/login`, `/workspace`, `/settings`
 - `MobileShell` remains responsible for shell selection, not for introducing mobile-only routes
 - Desktop `SettingsPage` keeps the current sidebar + content layout
 - Mobile `SettingsPage` must meet the spec requirement of `category -> detail`
@@ -57,7 +57,7 @@ This phase also does not change:
 The existing route model stays intact:
 
 - `/` -> `WelcomePage`
-- `/auth` -> `LoginPage`
+- `/login` -> `LoginPage`
 - `/workspace` -> `WorkspacePage` on desktop, `MobileWorkspaceScaffold` on mobile
 - `/settings` -> `SettingsPage`
 
@@ -280,4 +280,3 @@ Phase 4A is complete when all of the following are true:
 - On mobile, leaving the settings root uses history-first navigation with workspace/home fallback
 - On desktop, `Settings` still renders the existing sidebar/content layout
 - No Phase 3 mobile workspace behavior regresses
-

packages/server/src/app-routing.test.ts

@@ -141,6 +141,22 @@ describe("app routing", () => {
     expect(response.body).toContain('<div id="root">shell</div>');
   });
 
+  it("serves index.html for the /login frontend route", async () => {
+    const instance = await createApp();
+
+    const response = await instance.inject({
+      method: "GET",
+      url: "/login",
+      headers: {
+        accept: "text/html",
+      },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.headers["content-type"]).toContain("text/html");
+    expect(response.body).toContain('<div id="root">shell</div>');
+  });
+
   it("serves the built entrypoint when requesting /index.html directly", async () => {
     const instance = await createApp();
 

packages/server/src/auth/plugin.test.ts

@@ -295,4 +295,57 @@ describe("auth login protection", () => {
       error: "Authentication required",
     });
   });
+
+  it("does not treat the legacy /auth frontend path as a login redirect target", async () => {
+    const response = await app.inject({
+      method: "GET",
+      url: "/auth",
+      headers: {
+        accept: "text/html",
+      },
+    });
+
+    expect(response.statusCode).toBe(401);
+    expect(response.json()).toMatchObject({
+      ok: false,
+      error: "Authentication required",
+    });
+  });
+
+  it("does not treat unknown /auth/* paths as frontend navigations", async () => {
+    const response = await app.inject({
+      method: "GET",
+      url: "/auth/unknown",
+      headers: {
+        accept: "text/html",
+      },
+    });
+
+    expect(response.statusCode).toBe(401);
+    expect(response.json()).toMatchObject({
+      ok: false,
+      error: "Authentication required",
+    });
+  });
+
+  it("does not fall through to the SPA for GET /auth/login or GET /auth/logout", async () => {
+    const loginResponse = await app.inject({
+      method: "GET",
+      url: "/auth/login",
+      headers: {
+        accept: "text/html",
+      },
+    });
+
+    const logoutResponse = await app.inject({
+      method: "GET",
+      url: "/auth/logout",
+      headers: {
+        accept: "text/html",
+      },
+    });
+
+    expect(loginResponse.statusCode).toBe(404);
+    expect(logoutResponse.statusCode).toBe(404);
+  });
 });

packages/server/src/web-ui-routing.ts

@@ -1,7 +1,7 @@
 import type { FastifyRequest } from "fastify";
 
-const RESERVED_PREFIXES = ["/api/", "/internal/", "/assets/"];
-const RESERVED_EXACT_PATHS = new Set(["/api", "/assets", "/login", "/healthz", "/internal", "/ws"]);
+const RESERVED_PREFIXES = ["/api/", "/auth/", "/internal/", "/assets/"];
+const RESERVED_EXACT_PATHS = new Set(["/api", "/auth", "/assets", "/healthz", "/internal", "/ws"]);
 const ROOT_PUBLIC_FILE_PATHS = new Set(["/favicon.ico", "/index.html", "/task-complete.wav"]);
 
 export function getRequestPathname(url: string): string {