From 78cf516c4c2930d76a37f99881b3712245655078 Mon Sep 17 00:00:00 2001
From: saopig1 <4x7sw862st@gmail.com>
Date: Thu, 25 Jun 2026 12:01:10 +0800
Subject: [PATCH] feat(web/router): block guests from settings and setup routes

---
 web/src/router/index.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/web/src/router/index.ts b/web/src/router/index.ts
index 25d3b7c..ad1e49d 100644
--- a/web/src/router/index.ts
+++ b/web/src/router/index.ts
@@ -58,6 +58,12 @@ router.beforeEach(async (to) => {
     return { name: 'login', query: { next: to.fullPath } };
   }
 
+  // Guests may never reach settings/setup, even by typing the URL.
+  const GUEST_BLOCKED = new Set(['settings', 'setup']);
+  if (session.isGuest.value && GUEST_BLOCKED.has(to.name as string)) {
+    return { name: 'home' };
+  }
+
   // Navigation is allowed to proceed to `to` past here (auth/setup redirects above take precedence).
   // Sync + preserve the dedicated-link scope carried by ?bot.
   const store = usePlayerStore();