chore: default callbackUrl to /profile + drop unused demo routes + bump typescript-eslint to ^8.60

Author: mridang

app/routes/auth/login.tsx

@@ -22,7 +22,7 @@ interface AuthProvider {
 function LoginPage() {
   const search = Route.useSearch() as Record<string, string | undefined>;
   const error = search.error;
-  const callbackUrl = search.callbackUrl ?? '/';
+  const callbackUrl = search.callbackUrl ?? '/profile';
   const { message } = getMessage(error, 'signin-error');
 
   const [csrfToken, setCsrfToken] = useState('');

app/server.tsx

@@ -181,18 +181,6 @@ async function handleRequest(request: Request): Promise<Response> {
     }
   }
 
-  // Public API endpoint — no authentication required.
-  if (pathname === '/api/unprotected') {
-    return Response.json({ ok: true });
-  }
-
-  // Session-protected API endpoints — return 403 when unauthenticated.
-  if (pathname === '/api/secured' || pathname === '/api/protected/middleware') {
-    const session = await getSession(request);
-    if (!session) return Response.json({ error: 'Forbidden' }, { status: 403 });
-    return Response.json({ ok: true });
-  }
-
   // Everything else → TanStack Start SSR router
   return tanstackHandler(request);
 }

package-lock.json

@@ -46,7 +46,7 @@
     "prettier-plugin-tailwindcss": "^0.8.0",
     "tailwindcss": "^4.3.0",
     "typescript": "~5.9.2",
-    "typescript-eslint": "^8.20.0",
+    "typescript-eslint": "^8.60.0",
     "vite": "^7.3.2"
   }
 }