From f851e500f7525bb164be9fcbf1e1e54b7a56a188 Mon Sep 17 00:00:00 2001
From: AzuTear <vmbao62@hotmail.com>
Date: Thu, 25 Jun 2026 09:29:25 +0200
Subject: [PATCH] Make demo login gate backend-authoritative

---
 Backend/README.md      | 6 ++++--
 README.md              | 2 +-
 frontend/src/router.ts | 6 ++++--
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/Backend/README.md b/Backend/README.md
index 816b973..f2885f1 100644
--- a/Backend/README.md
+++ b/Backend/README.md
@@ -111,5 +111,7 @@ Frontend app-wide demo gate:
 VITE_DEMO_GATE_ENABLED=true
 ```
 
-- `true`: the whole Vue app starts at `/login` until a session exists.
-- unset or `false`: public pages such as `/` are visible without the initial demo login.
+- `true`: if `/api/public/site-status` is unavailable, the Vue app still starts at `/login` until a session exists.
+- unset or `false`: if `/api/public/site-status` is unavailable, public pages such as `/` remain visible without the initial demo login.
+
+When `/api/public/site-status` is reachable, the backend `demoLoginEnabled` flag is authoritative.
diff --git a/README.md b/README.md
index 4dc5675..0f44f3a 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ cp .env.example .env
 npm run dev
 ```
 
-The frontend uses a lightweight local session flow for development:
+The frontend uses a lightweight demo session flow for development and preview deployments:
 
 - Sign in from the header
 - `Viewer Login` unlocks nomination and voting
diff --git a/frontend/src/router.ts b/frontend/src/router.ts
index c58476f..8a6774b 100644
--- a/frontend/src/router.ts
+++ b/frontend/src/router.ts
@@ -4,7 +4,7 @@ import { useAuthStore } from './stores/auth'
 import { useAwardsStore } from './stores/awards'
 import { routes } from './router/routes'
 
-const DEMO_GATE_HARD_DISABLED = import.meta.env.VITE_DEMO_GATE_ENABLED === 'false'
+const DEMO_GATE_FALLBACK_ENABLED = import.meta.env.VITE_DEMO_GATE_ENABLED !== 'false'
 const contentAdminRoutes = new Set(['admin-content', 'admin-settings'])
 
 const router = createRouter({
@@ -35,7 +35,9 @@ router.beforeEach(async (to) => {
   const isAdminRoute = to.path.startsWith('/admin')
   const isMaintenancePreview = isMaintenanceRoute && to.query.preview === 'true'
   const siteStatus = await loadSiteStatus()
-  const demoGateEnabled = !DEMO_GATE_HARD_DISABLED && siteStatus?.demoLoginEnabled !== false
+  const demoGateEnabled = siteStatus
+    ? siteStatus.demoLoginEnabled
+    : DEMO_GATE_FALLBACK_ENABLED
 
   if (isMaintenancePreview && !authStore.isAdmin) {
     return { name: 'login', query: { redirect: to.fullPath } }