From c1247fb99cbf9d9d0dc687840aba4cdf8164e5da Mon Sep 17 00:00:00 2001
From: Chris Roth <chris@cjroth.com>
Date: Thu, 16 Apr 2026 15:38:30 -0400
Subject: [PATCH 1/3] chore: enable VITE_BYPASS_WAITLIST by default in
 .env.example

- uncomment the flag so local dev skips the waitlist out of the box
---
 .env.example | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.env.example b/.env.example
index 260f92752..cbdff9824 100644
--- a/.env.example
+++ b/.env.example
@@ -1,9 +1,7 @@
 # Thunderbolt Cloud URL (optional, defaults to http://localhost:8000)
 VITE_THUNDERBOLT_CLOUD_URL="http://localhost:8000/v1"
 
-# Bypass waitlist routes for UI development (set to "true" to skip waitlist)
-# Note: This only bypasses frontend routing, not backend auth
-# VITE_BYPASS_WAITLIST="true"
+VITE_BYPASS_WAITLIST="true"
 
 # Show app download links/banners in the web UI (set to "true" for internal testing deployments)
 # When enabled, desktop users see a sidebar section + bottom-right banner; mobile users see a top banner

From 3eff1d6cfad7bd0d0aa23345bf662784f9702abf Mon Sep 17 00:00:00 2001
From: Chris Roth <chris@cjroth.com>
Date: Thu, 16 Apr 2026 15:48:53 -0400
Subject: [PATCH 2/3] refactor: invert waitlist env var to opt-in
 VITE_ENABLE_WAITLIST

- Replace VITE_BYPASS_WAITLIST (opt-out) with VITE_ENABLE_WAITLIST (opt-in)
- Default behavior now skips the waitlist; deployments must explicitly enable it
- PR previews continue to bypass the waitlist regardless
---
 .env.example |  3 ++-
 src/app.tsx  | 14 +++++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/.env.example b/.env.example
index cbdff9824..330f286c5 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,8 @@
 # Thunderbolt Cloud URL (optional, defaults to http://localhost:8000)
 VITE_THUNDERBOLT_CLOUD_URL="http://localhost:8000/v1"
 
-VITE_BYPASS_WAITLIST="true"
+# Enable the waitlist gate (opt-in; leave unset to bypass the waitlist)
+# VITE_ENABLE_WAITLIST="true"
 
 # Show app download links/banners in the web UI (set to "true" for internal testing deployments)
 # When enabled, desktop users see a sidebar section + bottom-right banner; mobile users see a top banner
diff --git a/src/app.tsx b/src/app.tsx
index 5b8a348f9..4456b742c 100644
--- a/src/app.tsx
+++ b/src/app.tsx
@@ -87,7 +87,7 @@ const AppRoutes = ({ initData }: { initData: InitData }) => {
   })
 
   const oidcMode = isOidcMode()
-  const shouldBypassWaitlist = import.meta.env.VITE_BYPASS_WAITLIST === 'true' || isPrPreview()
+  const waitlistEnabled = import.meta.env.VITE_ENABLE_WAITLIST === 'true' && !isPrPreview()
 
   return (
     <Routes>
@@ -107,8 +107,8 @@ const AppRoutes = ({ initData }: { initData: InitData }) => {
         />
       )}
 
-      {/* Waitlist routes - unauthenticated only (skip when bypass or OIDC mode) */}
-      {!oidcMode && !shouldBypassWaitlist && (
+      {/* Waitlist routes - unauthenticated only (only when enabled and not OIDC mode) */}
+      {!oidcMode && waitlistEnabled && (
         <Route element={<AuthGate require="unauthenticated" redirectTo="/" />}>
           <Route path="waitlist" element={<WaitlistLayout />}>
             <Route index element={<WaitlistPage />} />
@@ -116,13 +116,13 @@ const AppRoutes = ({ initData }: { initData: InitData }) => {
         </Route>
       )}
 
-      {/* Main app routes - authenticated only (pass-through when bypass enabled) */}
+      {/* Main app routes - authenticated only (pass-through when waitlist disabled) */}
       <Route
         element={
-          shouldBypassWaitlist ? (
-            <Outlet />
-          ) : (
+          waitlistEnabled ? (
             <AuthGate require="authenticated" redirectTo={oidcMode ? '/oidc-redirect' : '/waitlist'} />
+          ) : (
+            <Outlet />
           )
         }
       >

From 9141bc65c4a3f5fb223820255538cba10e0f622c Mon Sep 17 00:00:00 2001
From: Chris Roth <chris@cjroth.com>
Date: Thu, 16 Apr 2026 16:01:30 -0400
Subject: [PATCH 3/3] chore: require auth for app routes when OIDC is enabled

- ensure AuthGate wraps main routes when oidcMode is on, even if
  waitlist is disabled, so unauthenticated users get redirected
---
 src/app.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/app.tsx b/src/app.tsx
index 4456b742c..87497737d 100644
--- a/src/app.tsx
+++ b/src/app.tsx
@@ -116,10 +116,10 @@ const AppRoutes = ({ initData }: { initData: InitData }) => {
         </Route>
       )}
 
-      {/* Main app routes - authenticated only (pass-through when waitlist disabled) */}
+      {/* Main app routes - authenticated only (pass-through when waitlist and OIDC both disabled) */}
       <Route
         element={
-          waitlistEnabled ? (
+          oidcMode || waitlistEnabled ? (
             <AuthGate require="authenticated" redirectTo={oidcMode ? '/oidc-redirect' : '/waitlist'} />
           ) : (
             <Outlet />