@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/templates/app/api/v1/users/[id]/meta/[key]/route.ts

@@ -28,7 +28,7 @@ import {
   handleCorsPreflightRequest,
   addCorsHeaders,
 } from '@nextsparkjs/core/lib/api/helpers'
-import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 import { z } from 'zod'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
@@ -41,8 +41,8 @@ const metadataValueSchema = z.object({
 })
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest()
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request)
 }
 
 /**
@@ -62,44 +62,29 @@ export const GET = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req)
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:read' })
 
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json(
-        createApiError('Authentication required', 401, null, 'AUTHENTICATION_FAILED'),
-        { status: 401 }
-      )
+      return createAuthFailureResponse(authResult)
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse
     }
 
-    // Check required permissions
-    const hasPermission =
-      authResult.type === 'session' ||
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'users:read'))
-
-    if (!hasPermission) {
-      const response = createApiError(
-        'Insufficient permissions. Admin access required for user metadata.',
-        403
-      )
-      return addCorsHeaders(response)
-    }
-
     const { id, key } = await params
 
     // Validate parameters
     if (!id || id.trim() === '') {
       const response = createApiError('User ID is required', 400, null, 'MISSING_USER_ID')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     if (!key || key.trim() === '') {
       const response = createApiError('Metadata key is required', 400, null, 'MISSING_META_KEY')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Validate key length
@@ -110,7 +95,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
         null,
         'INVALID_META_KEY'
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Get user metadata value using UserService
@@ -126,14 +111,14 @@ export const GET = withRateLimitTier(withApiLogging(async (
       key,
       value: metaValue ?? null,
     })
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   } catch (error) {
     const response = createApiError(
       'Failed to fetch user metadata',
       500,
       error instanceof Error ? error.message : undefined
     )
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
 }), 'read');
 
@@ -159,44 +144,29 @@ export const PUT = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req)
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' })
 
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json(
-        createApiError('Authentication required', 401, null, 'AUTHENTICATION_FAILED'),
-        { status: 401 }
-      )
+      return createAuthFailureResponse(authResult)
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse
     }
 
-    // Check required permissions
-    const hasPermission =
-      authResult.type === 'session' ||
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'users:write'))
-
-    if (!hasPermission) {
-      const response = createApiError(
-        'Insufficient permissions. Admin access required for user metadata.',
-        403
-      )
-      return addCorsHeaders(response)
-    }
-
     const { id, key } = await params
 
     // Validate parameters
     if (!id || id.trim() === '') {
       const response = createApiError('User ID is required', 400, null, 'MISSING_USER_ID')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     if (!key || key.trim() === '') {
       const response = createApiError('Metadata key is required', 400, null, 'MISSING_META_KEY')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Validate key length
@@ -207,7 +177,7 @@ export const PUT = withRateLimitTier(withApiLogging(async (
         null,
         'INVALID_META_KEY'
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Parse and validate request body
@@ -223,7 +193,7 @@ export const PUT = withRateLimitTier(withApiLogging(async (
         null,
         'VALUE_TOO_LARGE'
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Update metadata using UserService
@@ -245,7 +215,7 @@ export const PUT = withRateLimitTier(withApiLogging(async (
       value: validatedData.value,
       updated: true,
     })
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   } catch (error) {
     // Handle validation errors
     if (error instanceof z.ZodError) {
@@ -255,7 +225,7 @@ export const PUT = withRateLimitTier(withApiLogging(async (
         error.issues,
         'VALIDATION_ERROR'
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     const response = createApiError(
@@ -263,7 +233,7 @@ export const PUT = withRateLimitTier(withApiLogging(async (
       500,
       error instanceof Error ? error.message : undefined
     )
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
 }), 'write');
 
@@ -287,44 +257,29 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string; key: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req)
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' })
 
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json(
-        createApiError('Authentication required', 401, null, 'AUTHENTICATION_FAILED'),
-        { status: 401 }
-      )
+      return createAuthFailureResponse(authResult)
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse
     }
 
-    // Check required permissions
-    const hasPermission =
-      authResult.type === 'session' ||
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'users:write'))
-
-    if (!hasPermission) {
-      const response = createApiError(
-        'Insufficient permissions. Admin access required for user metadata.',
-        403
-      )
-      return addCorsHeaders(response)
-    }
-
     const { id, key } = await params
 
     // Validate parameters
     if (!id || id.trim() === '') {
       const response = createApiError('User ID is required', 400, null, 'MISSING_USER_ID')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     if (!key || key.trim() === '') {
       const response = createApiError('Metadata key is required', 400, null, 'MISSING_META_KEY')
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Validate key length
@@ -335,7 +290,7 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
         null,
         'INVALID_META_KEY'
       )
-      return addCorsHeaders(response)
+      return addCorsHeaders(response, req)
     }
 
     // Delete metadata using UserService
@@ -346,13 +301,13 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
       key,
       deleted: true,
     })
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   } catch (error) {
     const response = createApiError(
       'Failed to delete user metadata',
       500,
       error instanceof Error ? error.message : undefined
     )
-    return addCorsHeaders(response)
+    return addCorsHeaders(response, req)
   }
 }), 'write');

package/templates/app/api/v1/users/[id]/route.ts

@@ -11,7 +11,7 @@ import {
   handleEntityMetadataInResponse,
   processEntityMetadata
 } from '@nextsparkjs/core/lib/api/helpers';
-import { authenticateRequest, hasRequiredScope } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { z } from 'zod';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
@@ -24,8 +24,8 @@ const updateUserSchema = z.object({
 });
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest();
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request);
 }
 
 // GET /api/v1/users/:id - Get specific user
@@ -34,35 +34,24 @@ export const GET = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:read' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users need admin role, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'users:read'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for user management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     // Validate that id is not empty
     if (!id || id.trim() === '') {
       const response = createApiError('User ID or email is required', 400, null, 'MISSING_IDENTIFIER');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // Search by ID or email
@@ -74,7 +63,7 @@ export const GET = withRateLimitTier(withApiLogging(async (
 
     if (!user) {
       const response = createApiError('User not found', 404, null, 'USER_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // Handle metadata if requested (usando helper compartido)
@@ -82,11 +71,11 @@ export const GET = withRateLimitTier(withApiLogging(async (
     const userWithMeta = await includeEntityMetadataForSingle('user', user as { id: string }, metaParams, authResult.user!.id);
 
     const response = createApiResponse(userWithMeta);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error fetching user:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'read');
 
@@ -96,35 +85,24 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users need admin role, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'users:write'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for user management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     // Validate that id is not empty
     if (!id || id.trim() === '') {
       const response = createApiError('User ID or email is required', 400, null, 'MISSING_IDENTIFIER');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const body = await req.json();
@@ -162,7 +140,7 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
     
     if (!hasEntityFieldsToUpdate && !hasMetadataToUpdate) {
       const response = createApiError('No fields to update', 400, null, 'NO_FIELDS');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     let updatedUser;
@@ -183,7 +161,7 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
 
       if (result.rows.length === 0) {
         const response = createApiError('User not found', 404, null, 'USER_NOT_FOUND');
-        return addCorsHeaders(response);
+        return addCorsHeaders(response, req);
       }
 
       updatedUser = result.rows[0];
@@ -197,7 +175,7 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
 
       if (!user) {
         const response = createApiError('User not found', 404, null, 'USER_NOT_FOUND');
-        return addCorsHeaders(response);
+        return addCorsHeaders(response, req);
       }
 
       updatedUser = user;
@@ -214,16 +192,16 @@ export const PATCH = withRateLimitTier(withApiLogging(async (
     const responseData = await handleEntityMetadataInResponse('user', updatedUser as { id: string }, metadataWasProvided, authResult.user!.id);
 
     const response = createApiResponse(responseData);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     if (error instanceof z.ZodError) {
       const response = createApiError('Validation error', 400, error.issues, 'VALIDATION_ERROR');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
     
     console.error('Error updating user:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'write');
 
@@ -233,35 +211,24 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
   { params }: { params: Promise<{ id: string }> }
 ): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:delete' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse as NextResponse;
     }
 
-    // Check required permissions - session users need admin role, API key users need specific scope
-    const hasPermission = authResult.type === 'session' || 
-      (authResult.type === 'api-key' && hasRequiredScope(authResult, 'users:delete'));
-
-    if (!hasPermission) {
-      const response = createApiError('Insufficient permissions. Admin access required for user management.', 403);
-      return addCorsHeaders(response);
-    }
-
     const { id } = await params;
 
     // Validate that id is not empty
     if (!id || id.trim() === '') {
       const response = createApiError('User ID or email is required', 400, null, 'MISSING_IDENTIFIER');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // First, get the user to check if it exists and prevent self-deletion
@@ -273,13 +240,13 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
 
     if (!targetUser) {
       const response = createApiError('User not found', 404, null, 'USER_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     // Prevent self-deletion
     if ((targetUser as Record<string, unknown>).id === authResult.user!.id) {
       const response = createApiError('Cannot delete your own account via API', 403, null, 'SELF_DELETE_FORBIDDEN');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const result = await mutateWithRLS(
@@ -290,14 +257,14 @@ export const DELETE = withRateLimitTier(withApiLogging(async (
 
     if (result.rows.length === 0) {
       const response = createApiError('User not found', 404, null, 'USER_NOT_FOUND');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const response = createApiResponse({ deleted: true, id });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error deleting user:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'write');

package/templates/app/api/v1/users/route.ts

@@ -14,7 +14,7 @@ import {
   handleEntityMetadataInResponse,
   processEntityMetadata
 } from '@nextsparkjs/core/lib/api/helpers';
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth';
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth';
 import { hasAdminPermission } from '@nextsparkjs/core/lib/api/auth/permissions';
 import { z } from 'zod';
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
@@ -34,21 +34,19 @@ const createUserSchema = z.object({
 
 
 // Handle CORS preflight
-export async function OPTIONS() {
-  return handleCorsPreflightRequest();
+export async function OPTIONS(request: NextRequest) {
+  return handleCorsPreflightRequest(request);
 }
 
 // GET /api/v1/users - List users with dual auth
 export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:read' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
@@ -58,7 +56,7 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     // SECURITY: Only superadmins can list all users
     if (!hasAdminPermission(authResult, 'users:read')) {
       const response = createApiError('Insufficient permissions. Superadmin access required.', 403);
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const metaParams = parseMetaParams(req);
@@ -103,25 +101,23 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     const usersWithMeta = await includeEntityMetadata('user', users as { id: string }[], metaParams, authResult.user!.id);
 
     const response = createApiResponse(usersWithMeta, paginationMeta);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     console.error('Error fetching users:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'read');
 
 // POST /api/v1/users - Create user with dual auth
 export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
   try {
-    // Authenticate using dual auth
-    const authResult = await authenticateRequest(req);
-    
+    // Authenticate using dual auth; the API-key scope is declared at the entry
+    // point, which fails closed for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' });
+
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
 
     if (authResult.rateLimitResponse) {
@@ -131,7 +127,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     // SECURITY: Only superadmins can create users
     if (!hasAdminPermission(authResult, 'users:write')) {
       const response = createApiError('Insufficient permissions. Superadmin access required.', 403);
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const body = await req.json();
@@ -147,7 +143,7 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
 
     if (existingUser.length > 0) {
       const response = createApiError('Email already exists', 409, null, 'EMAIL_EXISTS');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
 
     const newUserId = globalThis.crypto.randomUUID();
@@ -183,16 +179,16 @@ export const POST = withRateLimitTier(withApiLogging(async (req: NextRequest): P
     const responseData = await handleEntityMetadataInResponse('user', createdUser as { id: string }, metadataWasProvided, authResult.user!.id);
     
     const response = createApiResponse(responseData, { created: true }, 201);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   } catch (error) {
     if (error instanceof z.ZodError) {
       const response = createApiError('Validation error', 400, error.issues, 'VALIDATION_ERROR');
-      return addCorsHeaders(response);
+      return addCorsHeaders(response, req);
     }
     
     console.error('Error creating user:', error);
     const response = createApiError('Internal server error', 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, req);
   }
 }), 'write');
 

package/templates/app/dashboard/layout.tsx

@@ -3,7 +3,7 @@
 import { useAuth } from '@nextsparkjs/core/hooks/useAuth'
 import { useRouter } from 'next/navigation'
 import { useEffect, Suspense } from 'react'
-import { Loader2 } from 'lucide-react'
+import { DashboardAuthSkeleton } from '@nextsparkjs/core/components/dashboard/layouts/DashboardAuthSkeleton'
 import { DashboardProviders } from '@nextsparkjs/core/providers/DashboardProviders'
 import { DashboardTranslationPreloader } from '@nextsparkjs/core/lib/i18n/DashboardTranslationPreloader'
 import { TranslationDebugger } from '@nextsparkjs/core/utils/dev/TranslationDebugger'
@@ -35,11 +35,7 @@ function DashboardLayoutContent({ children }: { children: React.ReactNode }) {
   }, [user, isLoading, router])
 
   if (isLoading) {
-    return (
-      <div className="min-h-screen flex items-center justify-center">
-        <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
-      </div>
-    )
+    return <DashboardAuthSkeleton />
   }
 
   if (!user) {