From cabedc30b024f5ddd39d80096c4c4910b61cca80 Mon Sep 17 00:00:00 2001 From: Nariman Jelveh Date: Mon, 17 Aug 2026 20:11:29 -0700 Subject: [PATCH] Require login on app landing pages Prevent first-time visitors from being treated as temporary users when they open an app landing page such as `/app/` or `/desktop/app/`. These routes now always go through the real login/signup flow. --- src/gui/src/initgui.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/gui/src/initgui.js b/src/gui/src/initgui.js index cc508acec..e8224582f 100644 --- a/src/gui/src/initgui.js +++ b/src/gui/src/initgui.js @@ -2003,9 +2003,12 @@ window.initgui = async function (options) { // ------------------------------------------------------------------------------------- // Un-authed but not first visit -> try to log in/sign up // ------------------------------------------------------------------------------------- + // App landing pages (`/app/`, incl. `/desktop/app/`) require a + // real account even on a first visit — never a temp user. + const is_app_landing_page = window.url_paths[0] === 'app' && !!window.url_paths[1]; if ( !window.is_auth() && - (!window.first_visit_ever || window.disable_temp_users) + (!window.first_visit_ever || window.disable_temp_users || is_app_landing_page) ) { // `npm start --server=` serves this GUI locally while pointing // `gui_origin` at a remote Puter. There is nothing here to log into: