Enhance middleware for route handling and authorization

- Added new public paths to the middleware to allow unauthenticated access to specific routes, improving user experience on the dashboard.
- Updated the host guard logic to ensure proper handling of tracking-only routes, returning a 404 for unauthorized access.
- Refactored the matcher configuration to streamline route matching for the middleware, enhancing overall performance and security.

Author: sagnik11

middleware.ts

@@ -25,38 +25,64 @@ const TRACKING_ALLOWED = [
   /^\/api\/webhooks\//,
   /^\/_next\/static\//,
   /^\/_next\/image/,
-  /^\/favicon\.ico$/,
+  /^\/favicon/,
+  /^\/assets\//,
+]
+
+// Routes that bypass the auth guard on the dashboard host.
+const PUBLIC_PATHS = [
+  /^\/login(\/|$)/,
+  /^\/api\/auth\//,
+  /^\/api\/v1\//,
+  /^\/api\/webhooks\//,
+  /^\/api\/public\//,
+  /^\/img\//,
+  /^\/accept-invite(\/|$)/,
+  /^\/unsubscribe(\/|$)/,
+  /^\/confirm(\/|$)/,
+  /^\/f\//,
+  /^\/form\//,
+  /^\/t\//,
+  /^\/r\//,
 ]
 
 const authMiddleware = withAuth({
   pages: { signIn: '/login' },
 })
 
 export default function middleware(req: NextRequest) {
-  const host = req.headers.get('host') || ''
+  const host = (req.headers.get('host') || '').toLowerCase()
   const path = req.nextUrl.pathname
 
-  // If TRACKING_URL is configured to a different host than APP_URL, restrict
-  // that host to tracking-only routes. Anything else 404s, so phishing scanners
-  // and curious crawlers won't see the login page on the tracker domain.
-  if (TRACKING_HOST && APP_HOST && TRACKING_HOST !== APP_HOST && host === TRACKING_HOST) {
-    const allowed = TRACKING_ALLOWED.some((re) => re.test(path))
-    if (!allowed) {
-      return new NextResponse('Not Found', { status: 404 })
+  // Host guard: if a separate tracking host is configured, lock it to
+  // tracking-only routes. Phishing scanners, crawlers, and casual visitors
+  // see a 404 on everything else, including /login.
+  if (
+    TRACKING_HOST &&
+    APP_HOST &&
+    TRACKING_HOST !== APP_HOST &&
+    host === TRACKING_HOST
+  ) {
+    if (TRACKING_ALLOWED.some((re) => re.test(path))) {
+      return NextResponse.next()
     }
-    return NextResponse.next()
+    return new NextResponse('Not Found', {
+      status: 404,
+      headers: {
+        'Content-Type': 'text/plain',
+        'Cache-Control': 'no-store, no-cache, must-revalidate',
+      },
+    })
   }
 
-  // Fall through to NextAuth middleware on the dashboard host.
+  // Dashboard host: skip auth for public routes, otherwise enforce it.
+  if (PUBLIC_PATHS.some((re) => re.test(path))) {
+    return NextResponse.next()
+  }
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   return (authMiddleware as any)(req)
 }
 
 export const config = {
-  matcher: [
-    '/((?!api/auth|api/v1|api/webhooks|api/public|img|login|accept-invite|unsubscribe|confirm|f|form|t|r|_next/static|_next/image|favicon.ico).*)',
-    '/r/:path*',
-    '/t/:path*',
-    '/unsubscribe/:path*',
-  ],
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
 }