PR8: D11/D12/D13 — public /pricing + /api/health, tighten middleware

[Regantih]

Summary

Three linked deliverables that make the marketing funnel and health-check endpoint work without requiring a login:

Ticket	File(s) changed	What it does
D13	middleware.ts	Adds /pricing and /api/health to PUBLIC_PATH_PREFIXES; they now pass through isPublicPath() and are never redirected to /login
D12	app/api/health/route.ts	Rewritten to always return HTTP 200 { status, commit, time }. No Supabase/Anthropic pings (those belong on a future /api/health/deep behind auth).
D11	app/pricing/page.tsx (new)	Real pricing page: Free Trial ($0, 3 deals/month, $5 LLM cap) → Pro ($49/mo, unlimited). ToS link, FAQ, Subscribe CTA → /signup?plan=pro. No fake data.
—	docs/BUILD_STATUS.md	PR8 entry added; pending items updated.

---

Root-cause diagnosis

Why /api/health redirected to /login (before this PR)

// middleware.ts — before
const PUBLIC_PATH_PREFIXES = ['/login', '/signup', '/auth/callback'];
//                              ↑ /api/health not here

Any unauthenticated request to /api/health hit !isPublicPath('/api/health') === true, triggering NextResponse.redirect('/login?next=/api/health'). The route handler never ran.

Why /pricing redirected to /login (before this PR)

Same cause — /pricing was not in PUBLIC_PATH_PREFIXES. Additionally, app/pricing/page.tsx did not exist, so the route would have 404'd even if middleware had allowed it through.

---

Changes (diff summary)

middleware.ts (D13)

-const PUBLIC_PATH_PREFIXES = ['/login', '/signup', '/auth/callback'];
+const PUBLIC_PATH_PREFIXES = [
+  '/login',
+  '/signup',
+  '/pricing',
+  '/api/health',
+  '/auth/callback',
+];

Matcher config and all auth logic unchanged — fix is additive only.

app/api/health/route.ts (D12)

Removed Supabase and Anthropic deep pings. New shape — always HTTP 200:

{ "status": "ok", "commit": "d6ea6b6", "time": "2026-05-10T14:44:31.000Z" }

export const dynamic = 'force-dynamic' retained so Vercel never serves a cached response.

app/pricing/page.tsx (D11, new file)

• Public Next.js server component, zero auth dependency
• Free Trial card: $0 · 3 deals/month · $5 LLM cap · full feature list
• Pro card: $49/mo · unlimited · priority routing — badge: "Most popular"
• Free Trial CTA → /signup
• Subscribe CTA → /signup?plan=pro (Stripe wired once STRIPE_SECRET_KEY is set)
• ToS link → GitHub LICENSE file (real URL; dedicated /terms page is a tracked pending item)
• Collapsible FAQ (5 factual entries — no lorem ipsum)
• Inline styles matching root layout — zero new npm dependencies

---

Vercel preview evidence

Preview URL: https://deallenz-git-pr8-public-route-8518c8-hemanths-projects-ac08a6f4.vercel.app
Vercel build status: ✅ success (DEPLOYED) — confirmed via GitHub commit status API at sha d6ea6b6
Vercel bot comment: Ready — deployment Awiv26h58

Note on curl evidence: The Vercel "Deployment Protection" (host-not-in-allowlist) returns 403 host_not_allowed for requests from the CI/build sandbox IP. This is a Vercel account-level setting — not caused by the middleware changes in this PR. The preview URL is accessible from your own browser.

Manual verification commands (run from your local machine)

PREVIEW="https://deallenz-git-pr8-public-route-8518c8-hemanths-projects-ac08a6f4.vercel.app"

# D12 — must be 200 JSON, never 307
curl -i "${PREVIEW}/api/health"
# Expected:
# HTTP/2 200
# content-type: application/json
# {"status":"ok","commit":"d6ea6b6","time":"2026-05-10T..."}

# D11 — must render HTML, never redirect
curl -si "${PREVIEW}/pricing" | head -6
# Expected:
# HTTP/2 200
# content-type: text/html; charset=utf-8

# Gated route still protected (sanity check)
curl -si "${PREVIEW}/dashboard" | grep -i location
# Expected: location: /login?next=%2Fdashboard

---

Acceptance criteria

• GET /api/health returns HTTP 200 JSON, never 307/302
• GET /api/health body contains status, commit, time keys
• /pricing renders without redirect for unauthenticated users
• /pricing shows Free Trial and Pro plan cards
• /pricing includes a Subscribe CTA (/signup?plan=pro) and a ToS link
• Protected routes (/dashboard, /api/upload, etc.) still redirect unauthenticated users to /login
• docs/BUILD_STATUS.md has PR8 entry
• Vercel build green ✅ (confirmed)

---

Test notes

• No package.json changes — zero new dependencies
• app/pricing/page.tsx imports only next/link and next (metadata) — both already in deps; no @/lib imports so no server-only boundary risk
• Middleware change is strictly additive — existing protected routes are unaffected
• app/api/health/route.ts no longer imports @/lib/supabase/server or @anthropic-ai/sdk — eliminates the risk of a 503 from unconfigured env vars during cold-start

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
deallenz	Ready	Preview, Comment	May 10, 2026 2:44pm