From 21e7e30b61c5131d745f27bd27cbdadc451f0d2d Mon Sep 17 00:00:00 2001
From: bruno <bruno.charest@gmail.com>
Date: Fri, 10 Jul 2026 15:58:24 -0400
Subject: [PATCH] fix: protect dashboard / route with auth check

Dashboard now calls _get_user_or_redirect() before rendering.
Unauthenticated users get redirected to /auth/login?provider=local.
All sensitive routes now protected: /, /workspace, /accounts/settings
---
 app/routers/dashboard.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/app/routers/dashboard.py b/app/routers/dashboard.py
index 156e55c..480edff 100644
--- a/app/routers/dashboard.py
+++ b/app/routers/dashboard.py
@@ -292,6 +292,9 @@ async def dashboard(
     search: str = Query(default=""),
     show_archived: bool = Query(default=False),
 ):
+    auth = _get_user_or_redirect(request)
+    if isinstance(auth, RedirectResponse):
+        return auth
     try:
         repos = await gitea.get_user_repos(page=1, limit=50)
         if search: