Auth hardening: JWT middleware, sign-in bypass fix, dev-mode gate, marketing build#21

Merged

Andrew5194 merged 6 commits into

mainfrom

tighten-dev-auth-and-fix-marketing-build

Apr 19, 2026

Commits on Apr 19, 2026

Harden dev auth bypass and fix marketing NEXT_PUBLIC_ build

authored and
Andrew Yang
committed
Fix sign-in bypass when a prior session cookie exists

authored and
Andrew Yang
committed
Replace sentinel-cookie auth with real NextAuth JWT verification

authored and
Andrew Yang
committed
Move middleware.ts into src/ so Next.js actually runs it

authored and
Andrew Yang
committed
Remove pre-signout in sign-in flow that was breaking CSRF

authored and
Andrew Yang
committed
Use session+email check for sign-in instead of parsing callback response

authored and
Andrew Yang
committed