mickasmt / next-saas-stripe-starter

Open-source SaaS Starter with User Roles & Admin Panel. Built using Next.js 14, Prisma, Neon, Auth.js v5, Resend, React Email, Shadcn/ui, Stripe, Server Actions.
https://next-saas-stripe-starter.vercel.app
MIT License
1.95k stars 357 forks source link

Some public urls like /terms and /privacy requires auth #31

Closed rakeshtembhurne closed 6 months ago

rakeshtembhurne commented 6 months ago

The URLs like /terms, /privacy, etc. requires auth. Trying to access these pages redirects user to sign in page. It's happening with all "Pages" created by contentlayer.

Reason for it is, in middleware.ts file we are checking if user is not logged in and the route is not in publicRoutes array, they should be redirected to the login. Since pages does not have any prefix like /docs or /guides, they are not being recognised as publicRoutes.

mickasmt commented 6 months ago

Hi, thanks for report this issue. You can fix that easily to add the links in publicRoutes like that :

In routes.ts file :

export const publicRoutes = [
  //...other routes,
  "/terms",
  "/privacy",
];

Do the same thing for your future public links and you will be good. middleware.ts will check if your url starts with some slug like /terms or /docs. [...slug] folder in the app folder will check if you have any files in the pages folder with the name equal to your slug in the url.

rakeshtembhurne commented 6 months ago

Hello @mickasmt, that's a good quick fix. You may want to fix it in the code for the project: https://next-saas-stripe-starter.vercel.app/register

image

My concern was, shouldn't we have all pages public by default? Just like guide, blog and docs, generally pages are public by default. And since they are being generated statically with contentlayer, its number might grow, just like blog entry. Having to edit publicRoutes manually each time we create a page, would defeat the purpose of letting it generate statically.

mickasmt commented 5 months ago

@rakeshtembhurne I understand, it's annoying to do it manually. But I prefer to leave it this way because some people who take over the project might want to block access to certain paths with the middleware. However, I understand that the normal paths should be public. I'll try to see if I can resolve this.