fix: guard encoded example routes by matched route ID

[devin-ai-integration]

Summary

The example app's protectedRoutesHandle (example/src/hooks.server.ts) matched request paths without normalizing percent-encoded segments, so encoded variants could miss the guard's prefix checks. This change normalizes the path before matching.

Please review before merging.

[devin-ai-integration]

Original prompt from Linear User

Please work on ticket "Authentication bypass of the reference route-protection handle hook via percent-encoded pathnames (example app protectedRoutesHandle)" (SEC-1332)

@playbook:playbook-b588614117c7477a9b9729928385384f

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[linear-code]

SEC-1332

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

Summary

The PR hardens and verifies the example application's protected-route handling.

• Uses SvelteKit's matched route ID instead of the percent-encoded request pathname when applying authentication policy.
• Preserves redirects for protected browser pages and JSON 401 responses for protected API routes.
• Adds Vitest coverage for encoded protected paths, authenticated requests, public routes, and unmatched routes.
• Enables test execution with coverage in CI.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Incoming request] --> B[AuthKit handle]
  B --> C[Populate event.locals.auth]
  C --> D[Protected-routes handle]
  D --> E{Matched route ID protected?}
  E -->|No| F[Resolve route]
  E -->|Yes, authenticated| F
  E -->|Yes, unauthenticated API| G[Return JSON 401]
  E -->|Yes, unauthenticated page| H[Redirect to login]

Loading

_{Reviews (2) · Last reviewed commit: "fix: recover encoded-route guard with CI..."}

[nicknisi]

Recovered this branch onto current main and added tests against the actual example route guard. Coverage includes canonical and encoded account/API paths, authenticated access, public routes, and unmatched routes. Enabled the test/coverage step in CI.

Verification: 39 tests passed with coverage, plus root typecheck, formatting, library build, and example build. The example typecheck passes with placeholder environment configuration. The standalone lint script still fails because of its pre-existing ESLint configuration, reproduced on current main; lint was already disabled in CI and remains unchanged. A fresh independent code review found no code blocker. Not merged or released.

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session