From f36f88f6ec7cd12d18b50386c406c855f1db2876 Mon Sep 17 00:00:00 2001
From: Ali HD <85040609+alihd-tech@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:58:22 +0330
Subject: [PATCH 1/4] Allow public routes without hosted session secret

---
 lib/session.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/session.ts b/lib/session.ts
index 9e0b827..234526c 100644
--- a/lib/session.ts
+++ b/lib/session.ts
@@ -27,6 +27,11 @@ export interface SessionData {
   githubAppOAuthState?: string
 }
 
+export function isSessionConfigured() {
+  const configured = process.env.SESSION_SECRET
+  return process.env.NODE_ENV !== "production" || Boolean(configured && configured.length >= 32)
+}
+
 function getSessionPassword() {
   const configured = process.env.SESSION_SECRET
   if (configured && configured.length >= 32) return configured
@@ -57,3 +62,8 @@ export async function getSession() {
     getSessionOptions()
   )
 }
+
+export async function getOptionalSession() {
+  if (!isSessionConfigured()) return null
+  return getSession()
+}

From 36b5ff15c291247b76119082958529f8475030ff Mon Sep 17 00:00:00 2001
From: Ali HD <85040609+alihd-tech@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:58:25 +0330
Subject: [PATCH 2/4] Decouple homepage from optional hosted auth

---
 app/page.tsx | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/app/page.tsx b/app/page.tsx
index 2ddc2f9..1360465 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -1,5 +1,5 @@
 import Link from "next/link"
-import { getSession } from "@/lib/session"
+import { getOptionalSession, isSessionConfigured } from "@/lib/session"
 import {
   Activity,
   BarChart3,
@@ -16,8 +16,11 @@ import { ThemeToggle } from "@/components/theme-toggle"
 import { UsernameForm } from "@/components/username-form"
 
 export default async function HomePage() {
-  const session = await getSession()
-  const signedIn = Boolean(session.user && session.accessToken)
+  const session = await getOptionalSession()
+  const signedIn = Boolean(session?.user && session?.accessToken)
+  const hostedAuthAvailable =
+    isSessionConfigured() &&
+    Boolean(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET)
 
   return (
     <div className="min-h-screen bg-background text-foreground flex flex-col">
@@ -106,12 +109,14 @@ export default async function HomePage() {
 
               <UsernameForm className="flex flex-col items-center" />
 
-              <Link
-                href={signedIn ? "/dashboard" : "/api/auth"}
-                className="text-xs text-muted-foreground underline-offset-4 hover:text-foreground hover:underline"
-              >
-                {signedIn ? "Open legacy hosted dashboard" : "Legacy hosted sign-in"}
-              </Link>
+              {(signedIn || hostedAuthAvailable) && (
+                <Link
+                  href={signedIn ? "/dashboard" : "/api/auth"}
+                  className="text-xs text-muted-foreground underline-offset-4 hover:text-foreground hover:underline"
+                >
+                  {signedIn ? "Open legacy hosted dashboard" : "Legacy hosted sign-in"}
+                </Link>
+              )}
             </div>
           </div>
 

From b308e0858e5969e1a76c3127d54dd8127c73a8fc Mon Sep 17 00:00:00 2001
From: Ali HD <85040609+alihd-tech@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:58:28 +0330
Subject: [PATCH 3/4] Keep public reports available without hosted sessions

---
 app/u/[username]/page.tsx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/u/[username]/page.tsx b/app/u/[username]/page.tsx
index d5a4b4d..fbe1890 100644
--- a/app/u/[username]/page.tsx
+++ b/app/u/[username]/page.tsx
@@ -7,7 +7,7 @@ import { GitHubLogoIcon } from "@radix-ui/react-icons"
 import { DashboardClient } from "@/components/dashboard-client"
 import { ThemeToggle } from "@/components/theme-toggle"
 import { fetchProfile, GitHubError, type PublicProfile } from "@/lib/github"
-import { getSession } from "@/lib/session"
+import { getOptionalSession } from "@/lib/session"
 
 interface Props {
   params: Promise<{ username: string }>
@@ -39,8 +39,8 @@ export default async function PublicReportPage({ params }: Props) {
   const profile = await loadProfile(username)
   if (!profile) notFound()
 
-  const session = await getSession()
-  const isOwner = session.user?.login.toLowerCase() === profile.login.toLowerCase()
+  const session = await getOptionalSession()
+  const isOwner = session?.user?.login.toLowerCase() === profile.login.toLowerCase()
 
   return (
     <div className="min-h-screen bg-background">

From 362ad84d3eee682e585636ae65d227259070871e Mon Sep 17 00:00:00 2001
From: Ali HD <85040609+alihd-tech@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:58:31 +0330
Subject: [PATCH 4/4] Gracefully handle unconfigured hosted sessions

---
 app/integrations/github/page.tsx | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/integrations/github/page.tsx b/app/integrations/github/page.tsx
index cb97eb0..15bbb2b 100644
--- a/app/integrations/github/page.tsx
+++ b/app/integrations/github/page.tsx
@@ -11,7 +11,7 @@ import {
   ShieldCheck,
   Users,
 } from "lucide-react"
-import { getSession } from "@/lib/session"
+import { getOptionalSession, isSessionConfigured } from "@/lib/session"
 import {
   getGitHubAppInstallation,
   isGitHubAppConfigured,
@@ -35,9 +35,9 @@ export default async function GitHubIntegrationPage({
   searchParams: Promise<Record<string, string | string[] | undefined>>
 }) {
   const params = await searchParams
-  const session = await getSession()
-  const configured = isGitHubAppConfigured()
-  const linked = session.githubAppInstallation
+  const session = await getOptionalSession()
+  const configured = isGitHubAppConfigured() && isSessionConfigured()
+  const linked = session?.githubAppInstallation
 
   let installation: Awaited<ReturnType<typeof getGitHubAppInstallation>> | null = null
   let repositories: Awaited<ReturnType<typeof listInstallationRepositories>> = []