@woodsportal/hubspot-kit 1.0.41-dev.4 → 1.0.41-dev.6

package/templates/scaffold/auth/_sso/src/app.tsx

@@ -0,0 +1,180 @@
+import { useEffect, useRef, useState } from 'react'
+import { RouterProvider } from '@tanstack/react-router'
+import { installCrossTabSessionListener } from 'woodsportal-client-sdk'
+
+import { api } from '@/integrations/woodsportal-sdk'
+import * as TanStackQueryProvider from '@/integrations/tanstack-query/root-provider'
+import { env } from '@/env'
+import Loader from '@/components/ui/loader/loader'
+import { skipCurrentPublicPath } from '@/utils/ValidationSchema'
+import { isHubSpotCmsEditor } from '@/hubspot/is-cms-editor'
+import { navigateAfterFullAuth, navigateToLogin } from '@/features/auth/auth-navigation'
+import { isProtectedHashPath, readHashPathname, isPublicAuthRoute } from '@/features/auth/auth-route-paths'
+import { hardReplaceToHashPath } from '@/utils/safe-router-navigation'
+import {
+  isFullyAuthenticatedSession,
+  isMfaPendingSession,
+  recoverMfaGateOnBoot,
+} from '@/features/auth/auth-session'
+import { shouldBootstrapRefreshSession } from '@/features/auth/app-bootstrap-guards'
+import {
+  clearClientAuthSession,
+  registerClientSessionQueryClear,
+} from '@/features/auth/clear-client-auth-session'
+import { ensureSsoCallbackRoute, hasOAuthCallbackInUrl } from '@/features/auth/sso-callback'
+import { Routes } from '@/config/routes'
+import { AUTH_SCAFFOLD_TIER } from '@/config/auth-tier'
+import type { router } from '@/integrations/tanstack-router/router'
+
+const BOOTSTRAP_TIMEOUT_MS = 35_000
+
+type AppProps = {
+  router: typeof router
+}
+
+export function App({ router }: AppProps) {
+  const session = api.auth.session
+  const [isLoading, setIsLoading] = useState(true)
+  const inCmsEditor = isHubSpotCmsEditor()
+  const initialBootstrapDone = useRef(false)
+  const bootstrapStarted = useRef(false)
+
+  useEffect(() => {
+    ensureSsoCallbackRoute()
+  }, [])
+
+  useEffect(() => {
+    const queryClient = TanStackQueryProvider.getContext().queryClient
+    registerClientSessionQueryClear(() => {
+      queryClient.cancelQueries()
+      queryClient.clear()
+    })
+    return installCrossTabSessionListener((kind) => {
+      if (kind === 'rev') {
+        clearClientAuthSession({ signalCrossTab: false })
+        queryClient.cancelQueries()
+        queryClient.clear()
+      }
+    })
+  }, [])
+
+  useEffect(() => {
+    if (bootstrapStarted.current) {
+      return
+    }
+    bootstrapStarted.current = true
+
+    if (!initialBootstrapDone.current) {
+      setIsLoading(true)
+    }
+
+    let mounted = true
+    const { logout } = api.auth.logout({})
+
+    const redirectProtectedPathToLogin = async (): Promise<void> => {
+      if (hasOAuthCallbackInUrl() || !skipCurrentPublicPath() || inCmsEditor) {
+        return
+      }
+      const hashPath = readHashPathname()
+      const routerPath = router?.state?.location?.pathname
+      const currentPath = routerPath && routerPath !== '/' ? routerPath : hashPath
+      const returnHref = router?.state?.location?.href ?? window.location.hash.replace(/^#/, '') ?? ''
+      const redirectPath =
+        currentPath !== Routes.login ? `?r=${encodeURIComponent(returnHref)}` : ''
+      const loginTarget = `${Routes.login}${redirectPath}`
+      await navigateToLogin(router, loginTarget)
+      if (isProtectedHashPath()) {
+        hardReplaceToHashPath(loginTarget)
+      }
+    }
+
+    const teardownAndRedirectToLogin = async (): Promise<void> => {
+      clearClientAuthSession()
+      try {
+        await logout()
+      } catch {
+        // stale session
+      }
+      await redirectProtectedPathToLogin()
+    }
+
+    const runBootstrap = async (): Promise<void> => {
+      if (AUTH_SCAFFOLD_TIER === 'full') {
+        await recoverMfaGateOnBoot()
+      }
+
+      const sessionRefreshExhausted = session.isSessionRefreshExhausted?.() ?? false
+      const refreshToken = session.getRefreshToken()
+      const hasRefresh =
+        !sessionRefreshExhausted &&
+        Boolean(refreshToken) &&
+        !session.isCookieExpired(env.VITE_REFRESH_TOKEN)
+
+      if (
+        !shouldBootstrapRefreshSession({
+          isMfaPendingSession: isMfaPendingSession(),
+          hasRefresh,
+          isPublicAuthRoute: isPublicAuthRoute(readHashPathname()),
+        })
+      ) {
+        if (!hasRefresh && skipCurrentPublicPath() && !hasOAuthCallbackInUrl() && !inCmsEditor) {
+          await teardownAndRedirectToLogin()
+        }
+        return
+      }
+
+      try {
+        await session.refreshSession({ force: true })
+      } catch {
+        if (!inCmsEditor) {
+          await teardownAndRedirectToLogin()
+        }
+        return
+      }
+
+      if (isFullyAuthenticatedSession()) {
+        const hashPath = readHashPathname()
+        if (hashPath === Routes.twoFa || hashPath === Routes.login) {
+          navigateAfterFullAuth(router)
+        }
+      }
+    }
+
+    const bootstrap = async () => {
+      try {
+        await Promise.race([
+          runBootstrap(),
+          new Promise<never>((_, reject) => {
+            window.setTimeout(() => reject(new Error('bootstrap_timeout')), BOOTSTRAP_TIMEOUT_MS)
+          }),
+        ])
+      } catch (error) {
+        if (!inCmsEditor && skipCurrentPublicPath() && !hasOAuthCallbackInUrl()) {
+          await teardownAndRedirectToLogin()
+        } else if (error instanceof Error && error.message !== 'bootstrap_timeout') {
+          throw error
+        }
+      } finally {
+        if (mounted) {
+          initialBootstrapDone.current = true
+          setIsLoading(false)
+        }
+      }
+    }
+
+    void bootstrap()
+    return () => {
+      mounted = false
+    }
+  }, [inCmsEditor, router])
+
+  if (isLoading) {
+    return <Loader showText={false} />
+  }
+
+  return (
+    <TanStackQueryProvider.Provider>
+      <RouterProvider router={router} />
+    </TanStackQueryProvider.Provider>
+  )
+}

package/templates/scaffold/auth/_sso/src/components/ui/auth/SsoLoginButton.tsx

@@ -0,0 +1,34 @@
+import { useState } from 'react'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/Button'
+import { api } from '@/integrations/woodsportal-sdk'
+
+export function SsoLoginButton() {
+  const [isLoading, setIsLoading] = useState(false)
+
+  const handleSso = async () => {
+    setIsLoading(true)
+    try {
+      const { authorize } = api.auth.sso.authorize()
+      const response = await authorize({})
+      const url =
+        (response as { data?: { authorizationUrl?: string } })?.data?.authorizationUrl ??
+        (response as { authorizationUrl?: string })?.authorizationUrl
+      if (!url) {
+        toast.error('SSO is not configured for this portal.')
+        return
+      }
+      window.location.assign(url)
+    } catch {
+      toast.error('Could not start SSO login.')
+    } finally {
+      setIsLoading(false)
+    }
+  }
+
+  return (
+    <Button type="button" variant="outline" className="w-full" disabled={isLoading} onClick={() => void handleSso()}>
+      {isLoading ? 'Redirecting…' : 'Continue with SSO'}
+    </Button>
+  )
+}

package/templates/scaffold/auth/_sso/src/config/auth-tier.ts

@@ -0,0 +1,4 @@
+/** Patched by `wp init-auth-scaffold` to `'starter' | 'sso' | 'full'`. */
+export const AUTH_SCAFFOLD_TIER = 'sso' as const
+
+export type AuthScaffoldTier = typeof AUTH_SCAFFOLD_TIER

package/templates/scaffold/auth/_sso/src/features/auth/components/starter-login.tsx

@@ -0,0 +1,83 @@
+import { useState } from 'react'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/Button'
+import { Form, FormField } from '@/components/ui/Form'
+import { Input } from '@/components/ui/Input'
+import { SsoLoginButton } from '@/components/ui/auth/SsoLoginButton'
+import { api } from '@/integrations/woodsportal-sdk'
+import { handleAuthLoginResponse, MFA_REQUIRED_SCAFFOLD_MESSAGE } from '@/features/auth/login-session-bridge'
+import { resolveAuthLoginErrorMessage } from '@/features/auth/resolve-auth-login-error-message'
+import {
+  getStoredLoginEmail,
+  setStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+
+export function StarterLogin() {
+  const router = useRouter()
+  const [email, setEmail] = useState(getStoredLoginEmail() ?? '')
+  const [password, setPassword] = useState('')
+  const [isSubmitting, setIsSubmitting] = useState(false)
+
+  const onSubmit = async (event: React.FormEvent) => {
+    event.preventDefault()
+    setIsSubmitting(true)
+    try {
+      setStoredLoginEmail(email)
+      const { login } = api.auth.login({})
+      const response = await login({ username: email.trim(), password })
+      const result = await handleAuthLoginResponse(response, router)
+      if (!result.success) {
+        if (result.reason === 'mfa_required') {
+          toast.error(MFA_REQUIRED_SCAFFOLD_MESSAGE)
+        } else {
+          toast.error('Login failed — no access token returned.')
+        }
+        return
+      }
+      if (!result.mfaRequired) {
+        toast.success('Signed in')
+      }
+    } catch (error) {
+      toast.error(resolveAuthLoginErrorMessage(error))
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  return (
+    <div className="w-full max-w-md rounded-lg border border-gray-200 bg-white p-6 shadow-sm">
+      <h1 className="mb-2 text-xl font-semibold text-gray-900">Sign in</h1>
+      <p className="mb-6 text-sm text-gray-600">Use your portal email and password or SSO.</p>
+      <Form onSubmit={onSubmit}>
+        <FormField label="Email">
+          <Input
+            type="email"
+            autoComplete="email"
+            required
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+          />
+        </FormField>
+        <FormField label="Password">
+          <Input
+            type="password"
+            autoComplete="current-password"
+            required
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
+        </FormField>
+        <Button type="submit" className="w-full" disabled={isSubmitting}>
+          {isSubmitting ? 'Signing in…' : 'Sign in'}
+        </Button>
+      </Form>
+      <div className="my-4 flex items-center gap-3 text-xs text-gray-500">
+        <span className="h-px flex-1 bg-gray-200" />
+        or
+        <span className="h-px flex-1 bg-gray-200" />
+      </div>
+      <SsoLoginButton />
+    </div>
+  )
+}

package/templates/scaffold/auth/_sso/src/features/auth/sso-callback.ts

@@ -0,0 +1,120 @@
+import { Routes } from '@/config/routes'
+import { readHashPathname } from '@/features/auth/auth-route-paths'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+
+export type SsoCallbackParams = {
+  code: string
+  state: string
+}
+
+export const SSO_CALLBACK_EXCHANGE_TIMEOUT_MS = 30_000
+
+const processedKeys = new Set<string>()
+
+export function buildSsoCallbackKey(code: string, state: string): string {
+  return `${code}:${state}`
+}
+
+export function normalizeOAuthQueryValue(value: unknown): string {
+  if (typeof value === 'string') {
+    return value.trim()
+  }
+  if (Array.isArray(value)) {
+    const first = value.find((entry) => typeof entry === 'string' && entry.trim())
+    return typeof first === 'string' ? first.trim() : ''
+  }
+  return ''
+}
+
+export function parseSsoCallbackParams(
+  routeSearch?: { code?: unknown; state?: unknown },
+): SsoCallbackParams {
+  const fromRoute = {
+    code: normalizeOAuthQueryValue(routeSearch?.code),
+    state: normalizeOAuthQueryValue(routeSearch?.state),
+  }
+  if (fromRoute.code && fromRoute.state) {
+    return fromRoute
+  }
+  if (typeof window === 'undefined') {
+    return { code: '', state: '' }
+  }
+  const hashPart = window.location.hash || ''
+  const queryFromHash = hashPart.includes('?') ? hashPart.split('?')[1] : ''
+  const searchParams = new URLSearchParams(queryFromHash || window.location.search)
+  return {
+    code: searchParams.get('code')?.trim() ?? '',
+    state: searchParams.get('state')?.trim() ?? '',
+  }
+}
+
+export function hasOAuthCallbackInUrl(routeSearch?: { code?: unknown; state?: unknown }): boolean {
+  const { code, state } = parseSsoCallbackParams(routeSearch)
+  return Boolean(code && state)
+}
+
+export function clearPreHashQueryParams(): void {
+  if (typeof window === 'undefined' || !window.location.search) {
+    return
+  }
+  window.history.replaceState(null, '', `${window.location.pathname}${window.location.hash}`)
+}
+
+export function isSsoCallbackAlreadyProcessed(key: string): boolean {
+  return processedKeys.has(key)
+}
+
+export function markSsoCallbackProcessed(key: string): void {
+  processedKeys.add(key)
+}
+
+export async function withSsoCallbackTimeout<T>(promise: Promise<T>): Promise<T> {
+  return Promise.race([
+    promise,
+    new Promise<T>((_, reject) => {
+      window.setTimeout(
+        () => reject(new Error('sso_callback_timeout')),
+        SSO_CALLBACK_EXCHANGE_TIMEOUT_MS,
+      )
+    }),
+  ])
+}
+
+const exchangeLocks = new Map<string, Promise<void>>()
+
+export async function runSharedSsoCallbackExchange(
+  key: string,
+  exchange: () => Promise<void>,
+): Promise<void> {
+  const existing = exchangeLocks.get(key)
+  if (existing) {
+    return existing
+  }
+  const run = exchange().finally(() => {
+    exchangeLocks.delete(key)
+  })
+  exchangeLocks.set(key, run)
+  return run
+}
+
+export function ensureSsoCallbackRoute(): boolean {
+  if (typeof window === 'undefined') {
+    return false
+  }
+  const { code, state } = parseSsoCallbackParams()
+  if (!code || !state) {
+    return false
+  }
+  const hashPath = readHashPathname()
+  if (normalizeRouterPath(hashPath) === Routes.ssoLogin) {
+    if (window.location.search) {
+      clearPreHashQueryParams()
+    }
+    return true
+  }
+  if (window.location.search) {
+    clearPreHashQueryParams()
+  }
+  window.location.hash = `#${Routes.ssoLogin}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`
+  return true
+}

package/templates/scaffold/auth/_sso/src/features/auth/use-sso-callback-handler.ts

@@ -0,0 +1,92 @@
+import { useEffect, useState } from 'react'
+import type { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import { api } from '@/integrations/woodsportal-sdk'
+import { handleAuthLoginResponse } from '@/features/auth/login-session-bridge'
+import {
+  buildSsoCallbackKey,
+  clearPreHashQueryParams,
+  isSsoCallbackAlreadyProcessed,
+  markSsoCallbackProcessed,
+  parseSsoCallbackParams,
+  runSharedSsoCallbackExchange,
+  withSsoCallbackTimeout,
+} from '@/features/auth/sso-callback'
+import { Routes } from '@/config/routes'
+
+type SsoRouter = ReturnType<typeof useRouter>
+
+export function useSsoCallbackHandler(options: {
+  router: SsoRouter
+  routeSearch?: { code?: string; state?: string }
+}): { isLoading: boolean } {
+  const { router, routeSearch } = options
+  const [isLoading, setIsLoading] = useState(true)
+
+  useEffect(() => {
+    let cancelled = false
+
+    const run = async () => {
+      const { code, state } = parseSsoCallbackParams(routeSearch)
+      const callbackKey = buildSsoCallbackKey(code, state)
+
+      try {
+        if (!code || !state) {
+          toast.error('Missing SSO callback parameters.')
+          router.history.replace(Routes.login)
+          return
+        }
+
+        if (isSsoCallbackAlreadyProcessed(callbackKey)) {
+          toast.error('SSO callback already processed. Please try again.')
+          router.history.replace(Routes.login)
+          return
+        }
+
+        await runSharedSsoCallbackExchange(callbackKey, async () => {
+          const { callback: ssoCallback } = api.auth.sso.callback()
+          const response = await withSsoCallbackTimeout(
+            ssoCallback({ queryParams: { code, state } }),
+          )
+
+          if (cancelled) {
+            return
+          }
+
+          const result = await handleAuthLoginResponse(response, router, {
+            clearPreHashQuery: clearPreHashQueryParams,
+          })
+
+          if (!result.success) {
+            toast.error('SSO login failed.')
+            router.history.replace(Routes.login)
+            return
+          }
+
+          markSsoCallbackProcessed(callbackKey)
+          if (!result.mfaRequired) {
+            toast.success(
+              (response as { statusMsg?: string })?.statusMsg || 'Signed in with SSO',
+            )
+          }
+        })
+      } catch {
+        if (!cancelled) {
+          toast.error('SSO login failed.')
+          router.history.replace(Routes.login)
+        }
+      } finally {
+        if (!cancelled) {
+          setIsLoading(false)
+        }
+      }
+    }
+
+    void run()
+    return () => {
+      cancelled = true
+    }
+  }, [router, routeSearch])
+
+  return { isLoading }
+}

package/templates/scaffold/auth/_sso/src/routeTree.gen.ts

@@ -0,0 +1,155 @@
+/* eslint-disable */
+// @ts-nocheck
+// TanStack Router generated route tree (starter + SSO tier).
+
+import { Route as rootRouteImport } from './routes/__root'
+import { Route as UnauthorizedRouteImport } from './routes/unauthorized'
+import { Route as GuideRouteImport } from './routes/guide'
+import { Route as IndexRouteImport } from './routes/index'
+import { Route as AuthLoginRouteImport } from './routes/_auth/login'
+import { Route as AuthLoginSsoRouteImport } from './routes/_auth/login/sso'
+import { Route as AppPortalRouteImport } from './routes/_app/portal'
+
+const UnauthorizedRoute = UnauthorizedRouteImport.update({
+  id: '/unauthorized',
+  path: '/unauthorized',
+  getParentRoute: () => rootRouteImport,
+} as any)
+
+const GuideRoute = GuideRouteImport.update({
+  id: '/guide',
+  path: '/guide',
+  getParentRoute: () => rootRouteImport,
+} as any)
+
+const IndexRoute = IndexRouteImport.update({
+  id: '/',
+  path: '/',
+  getParentRoute: () => rootRouteImport,
+} as any)
+
+const AuthLoginRoute = AuthLoginRouteImport.update({
+  id: '/_auth/login',
+  path: '/login',
+  getParentRoute: () => rootRouteImport,
+} as any)
+
+const AuthLoginSsoRoute = AuthLoginSsoRouteImport.update({
+  id: '/_auth/login/sso',
+  path: '/sso',
+  getParentRoute: () => AuthLoginRoute,
+} as any)
+
+const AppPortalRoute = AppPortalRouteImport.update({
+  id: '/_app/portal',
+  path: '/portal',
+  getParentRoute: () => rootRouteImport,
+} as any)
+
+const AuthLoginRouteWithChildren = AuthLoginRoute._addFileChildren({
+  AuthLoginSsoRoute,
+})
+
+export interface FileRoutesByFullPath {
+  '/': typeof IndexRoute
+  '/guide': typeof GuideRoute
+  '/login': typeof AuthLoginRouteWithChildren
+  '/login/sso': typeof AuthLoginSsoRoute
+  '/portal': typeof AppPortalRoute
+  '/unauthorized': typeof UnauthorizedRoute
+}
+
+export interface FileRoutesByTo {
+  '/': typeof IndexRoute
+  '/guide': typeof GuideRoute
+  '/login': typeof AuthLoginRouteWithChildren
+  '/login/sso': typeof AuthLoginSsoRoute
+  '/portal': typeof AppPortalRoute
+  '/unauthorized': typeof UnauthorizedRoute
+}
+
+export interface FileRoutesById {
+  __root__: typeof rootRouteImport
+  '/': typeof IndexRoute
+  '/guide': typeof GuideRoute
+  '/_auth/login': typeof AuthLoginRouteWithChildren
+  '/_auth/login/sso': typeof AuthLoginSsoRoute
+  '/_app/portal': typeof AppPortalRoute
+  '/unauthorized': typeof UnauthorizedRoute
+}
+
+export interface FileRouteTypes {
+  fileRoutesByFullPath: FileRoutesByFullPath
+  fullPaths: '/' | '/guide' | '/login' | '/login/sso' | '/portal' | '/unauthorized'
+  fileRoutesByTo: FileRoutesByTo
+  to: '/' | '/guide' | '/login' | '/login/sso' | '/portal' | '/unauthorized'
+  id: '__root__' | '/' | '/guide' | '/_auth/login' | '/_auth/login/sso' | '/_app/portal' | '/unauthorized'
+  fileRoutesById: FileRoutesById
+}
+
+export interface RootRouteChildren {
+  IndexRoute: typeof IndexRoute
+  GuideRoute: typeof GuideRoute
+  AuthLoginRoute: typeof AuthLoginRouteWithChildren
+  AppPortalRoute: typeof AppPortalRoute
+  UnauthorizedRoute: typeof UnauthorizedRoute
+}
+
+declare module '@tanstack/react-router' {
+  interface FileRoutesByPath {
+    '/unauthorized': {
+      id: '/unauthorized'
+      path: '/unauthorized'
+      fullPath: '/unauthorized'
+      preLoaderRoute: typeof UnauthorizedRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+    '/guide': {
+      id: '/guide'
+      path: '/guide'
+      fullPath: '/guide'
+      preLoaderRoute: typeof GuideRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+    '/': {
+      id: '/'
+      path: '/'
+      fullPath: '/'
+      preLoaderRoute: typeof IndexRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+    '/login': {
+      id: '/_auth/login'
+      path: '/login'
+      fullPath: '/login'
+      preLoaderRoute: typeof AuthLoginRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+    '/login/sso': {
+      id: '/_auth/login/sso'
+      path: '/sso'
+      fullPath: '/login/sso'
+      preLoaderRoute: typeof AuthLoginSsoRouteImport
+      parentRoute: typeof AuthLoginRouteImport
+    }
+    '/portal': {
+      id: '/_app/portal'
+      path: '/portal'
+      fullPath: '/portal'
+      preLoaderRoute: typeof AppPortalRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+  }
+}
+
+const rootRouteChildren: RootRouteChildren = {
+  IndexRoute,
+  GuideRoute,
+  AuthLoginRoute: AuthLoginRouteWithChildren,
+  AppPortalRoute,
+  UnauthorizedRoute,
+}
+
+export const routeTree = rootRouteImport
+  ._addFileChildren(rootRouteChildren)
+  ._addFileTypes<FileRouteTypes>()

package/templates/scaffold/auth/_sso/src/routes/_auth/login/sso.tsx

@@ -0,0 +1,27 @@
+import { createFileRoute, useRouter } from '@tanstack/react-router'
+import Loader from '@/components/ui/loader/loader'
+import { useSsoCallbackHandler } from '@/features/auth/use-sso-callback-handler'
+
+function SsoCallbackPage() {
+  const router = useRouter()
+  const search = Route.useSearch()
+  const { isLoading } = useSsoCallbackHandler({ router, routeSearch: search })
+
+  if (isLoading) {
+    return <Loader text="Completing SSO sign-in…" />
+  }
+
+  return null
+}
+
+export const Route = createFileRoute('/_auth/login/sso')({
+  component: SsoCallbackPage,
+  validateSearch: (search: Record<string, unknown>) => ({
+    code: typeof search.code === 'string' ? search.code : undefined,
+    state: typeof search.state === 'string' ? search.state : undefined,
+  }),
+  beforeLoad: () => ({
+    layout: 'AuthLayout' as const,
+    requiresAuth: false,
+  }),
+})