Disable login and signup on master (auth only on dev branch)

Made-with: Cursor

Author: owenbcoding

app/Http/Middleware/EnsureAuthPublic.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAuthPublic
+{
+    /**
+     * Paths that are disabled when auth is not public (login/signup disabled).
+     */
+    protected array $authPaths = [
+        'login',
+        'register',
+        'forgot-password',
+        'reset-password',
+        'two-factor-challenge',
+        'email/verify',
+    ];
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (config('services.auth_public', true)) {
+            return $next($request);
+        }
+
+        $path = trim($request->path(), '/');
+
+        foreach ($this->authPaths as $authPath) {
+            if ($path === $authPath || str_starts_with($path, $authPath.'/')) {
+                return redirect()->route('home')
+                    ->with('status', 'Login and sign up are not available.');
+            }
+        }
+
+        return $next($request);
+    }
+}

bootstrap/app.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Middleware\EnsureAuthPublic;
 use App\Http\Middleware\HandleAppearance;
 use App\Http\Middleware\HandleInertiaRequests;
 use Illuminate\Foundation\Application;
@@ -17,6 +18,7 @@
         $middleware->encryptCookies(except: ['appearance', 'sidebar_state']);
 
         $middleware->web(append: [
+            EnsureAuthPublic::class,
             HandleAppearance::class,
             HandleInertiaRequests::class,
             AddLinkHeadersForPreloadedAssets::class,

config/services.php

@@ -36,4 +36,16 @@
         ],
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Auth public (login / signup)
+    |--------------------------------------------------------------------------
+    |
+    | When true, /login and /register are available. When false, they redirect
+    | to home. Default is false on master (auth disabled); set AUTH_PUBLIC=true
+    | or use the dev branch for login/signup.
+    |
+    */
+    'auth_public' => env('AUTH_PUBLIC', false),
+
 ];

routes/web.php

@@ -20,7 +20,7 @@
 
 Route::get('/', function () {
     return Inertia::render('Welcome', [
-        'canRegister' => Features::enabled(Features::registration()),
+        'canRegister' => config('services.auth_public', true) && Features::enabled(Features::registration()),
     ]);
 })->name('home');
 

tests/Feature/Auth/AuthenticationTest.php

@@ -4,6 +4,12 @@
 use Illuminate\Support\Facades\RateLimiter;
 use Laravel\Fortify\Features;
 
+beforeEach(function () {
+    if (! auth_public()) {
+        $this->markTestSkipped('Login/signup is disabled on this branch.');
+    }
+});
+
 test('login screen can be rendered', function () {
     $response = $this->get(route('login'));
 

tests/Feature/Auth/PasswordConfirmationTest.php

@@ -3,6 +3,12 @@
 use App\Models\User;
 use Inertia\Testing\AssertableInertia as Assert;
 
+beforeEach(function () {
+    if (! auth_public()) {
+        $this->markTestSkipped('Login/signup is disabled on this branch.');
+    }
+});
+
 test('confirm password screen can be rendered', function () {
     $user = User::factory()->create();
 
@@ -18,5 +24,5 @@
 test('password confirmation requires authentication', function () {
     $response = $this->get(route('password.confirm'));
 
-    $response->assertRedirect(route('login'));
+    $response->assertRedirect(guest_redirect_target());
 });

tests/Feature/Auth/PasswordResetTest.php

@@ -4,6 +4,12 @@
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Support\Facades\Notification;
 
+beforeEach(function () {
+    if (! auth_public()) {
+        $this->markTestSkipped('Login/signup is disabled on this branch.');
+    }
+});
+
 test('reset password link screen can be rendered', function () {
     $response = $this->get(route('password.request'));
 

tests/Feature/Auth/RegistrationTest.php

@@ -1,5 +1,11 @@
 <?php
 
+beforeEach(function () {
+    if (! auth_public()) {
+        $this->markTestSkipped('Login/signup is disabled on this branch.');
+    }
+});
+
 test('registration screen can be rendered', function () {
     $response = $this->get(route('register'));
 

tests/Feature/Auth/TwoFactorChallengeTest.php

@@ -4,6 +4,12 @@
 use Inertia\Testing\AssertableInertia as Assert;
 use Laravel\Fortify\Features;
 
+beforeEach(function () {
+    if (! auth_public()) {
+        $this->markTestSkipped('Login/signup is disabled on this branch.');
+    }
+});
+
 test('two factor challenge redirects to login when not authenticated', function () {
     if (! Features::canManageTwoFactorAuthentication()) {
         $this->markTestSkipped('Two-factor authentication is not enabled.');

tests/Feature/ChangelogEntryTest.php

@@ -9,8 +9,8 @@
 use function Pest\Laravel\patch;
 use function Pest\Laravel\delete;
 
-it('redirects guests from changelog index to login', function () {
-    get(route('changelog.index'))->assertRedirect(route('login'));
+it('redirects guests from changelog index to login or home when auth disabled', function () {
+    get(route('changelog.index'))->assertRedirect(guest_redirect_target());
 });
 
 it('lists only the authenticated users changelog entries', function () {