b556c636eb
Replaced loose includes()/startsWith() path checks with exact equality for static routes and strict prefix matching for dynamic-token routes. Added /forgot-password and /reset-password to the allowlist so the password-reset flow is usable without auth. Extracted isAuthPublicPath as a pure testable function with 14 unit tests covering regressions. |
||
|---|---|---|
| .. | ||
| public | ||
| scripts | ||
| src | ||
| tests | ||
| index.html | ||
| package-lock.json | ||
| package.json | ||
| postcss.config.js | ||
| tailwind.config.js | ||
| tsconfig.json | ||
| vite.config.js | ||
| vitest.config.ts | ||