From 5a49ecb2cffbe3cfea1b267473e4db88fd2b02d4 Mon Sep 17 00:00:00 2001 From: Moheeb Zara Date: Sat, 16 May 2026 17:06:00 -0700 Subject: [PATCH] fix(forms): allow anonymous access to the public /f/[slug] page MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The middleware PUBLIC_ROUTES allowlist did not include the public form/waiver fill route, so unauthenticated visitors hitting /f/ were redirected to /login — making the entire public/ anonymous forms feature unreachable in production. Add '/f' to the allowlist; only /f/[slug] lives under it (the /forms* management routes do not match the '/f/' prefix and stay auth-gated). The page already serves only published public forms and submitForm enforces visibility, so this exposes nothing new. --- proxy.ts | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/proxy.ts b/proxy.ts index da98268..684dc86 100644 --- a/proxy.ts +++ b/proxy.ts @@ -13,6 +13,11 @@ const PUBLIC_ROUTES = [ '/signup', '/auth', '/api/health', + // Public form / waiver fill page. Only /f/[slug] lives here and must be + // reachable anonymously (the page serves only published public forms and + // submitForm enforces visibility). The /forms* management routes do NOT + // match the '/f/' prefix and stay auth-gated. + '/f', '/resources', '/zine', '/governance',