Redirect root to dashboard

[JacobHayes]

Summary

• Add an app-level GET/HEAD / redirect to /dashboard in the TemperPaw auth middleware.
• Keep dashboard serving under /dashboard and leave platform/API surfaces untouched.
• Add regression coverage that /api, /observe, /paw, /tdata, /auth, /triggers, /healthz, and /readyz representative paths still pass through the middleware.

Notes

• Small UX/auth-routing adjustment; no ADR added.
• This removes the need for proxy-specific root redirects such as Caddy redir / /dashboard.

Proof

• .proofs/2026-07-07-root-dashboard-redirect.md

Tests

• Red confirmed before implementation: cargo test -p temperpaw auth::tests::unauthenticated_root_redirects_to_dashboard_without_proxy_help -- --nocapture failed with / returning 401 instead of 307.
• cargo test -p temperpaw auth::tests:: -- --nocapture
• cargo fmt --check
• cargo test -p temperpaw

Greptile Summary

This PR adds an unconditional GET/HEAD / → /dashboard redirect directly inside the TemperPaw auth middleware, removing the need for proxy-level (e.g. Caddy) root redirects.

• A new helper is_dashboard_root_redirect_path matches only GET and HEAD requests to / exactly, and the corresponding early-return at the top of middleware emits a 307 Temporary Redirect before any auth logic runs.
• Two new tests cover the redirect (integration-level 307 + Location header check) and the helper's negative cases (POST /, /healthz, /api/probe).

Confidence Score: 5/5

Safe to merge — the redirect logic is minimal, isolated to the top of the middleware, and does not touch any auth checks for other paths.

The change is a four-line early return that fires only on GET/HEAD to exactly '/'. All other paths, methods, and auth flows are completely unaffected. The helper is pure and trivially correct; the integration test validates the 307 + Location header end-to-end; and the negative-case unit test confirms that no other paths are accidentally intercepted.

No files require special attention.

Important Files Changed

Filename	Overview
crates/temperpaw/src/auth.rs	Adds a pre-auth 307 redirect for GET/HEAD / → /dashboard; helper function and two new tests are clean and correct.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Client
    participant Middleware as Auth Middleware
    participant Dashboard as /dashboard
    participant LoginPage as /dashboard/login

    Note over Client,LoginPage: Unauthenticated user visits /

    Client->>Middleware: GET /
    Middleware-->>Client: 307 Temporary Redirect → /dashboard

    Client->>Middleware: GET /dashboard
    Middleware->>Middleware: check auth (no cookie/token)
    Middleware-->>Client: 307 Temporary Redirect → /dashboard/login

    Client->>Middleware: GET /dashboard/login
    Middleware->>Middleware: is_dashboard_public_path → true
    Middleware->>LoginPage: pass through
    LoginPage-->>Client: 200 OK (login form)

    Note over Client,LoginPage: Authenticated user visits /

    Client->>Middleware: GET /
    Middleware-->>Client: 307 Temporary Redirect → /dashboard

    Client->>Middleware: GET /dashboard
    Middleware->>Middleware: claims_from_headers → valid cookie
    Middleware->>Dashboard: pass through (with injected auth headers)
    Dashboard-->>Client: 200 OK

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Client
    participant Middleware as Auth Middleware
    participant Dashboard as /dashboard
    participant LoginPage as /dashboard/login

    Note over Client,LoginPage: Unauthenticated user visits /

    Client->>Middleware: GET /
    Middleware-->>Client: 307 Temporary Redirect → /dashboard

    Client->>Middleware: GET /dashboard
    Middleware->>Middleware: check auth (no cookie/token)
    Middleware-->>Client: 307 Temporary Redirect → /dashboard/login

    Client->>Middleware: GET /dashboard/login
    Middleware->>Middleware: is_dashboard_public_path → true
    Middleware->>LoginPage: pass through
    LoginPage-->>Client: 200 OK (login form)

    Note over Client,LoginPage: Authenticated user visits /

    Client->>Middleware: GET /
    Middleware-->>Client: 307 Temporary Redirect → /dashboard

    Client->>Middleware: GET /dashboard
    Middleware->>Middleware: claims_from_headers → valid cookie
    Middleware->>Dashboard: pass through (with injected auth headers)
    Dashboard-->>Client: 200 OK

Loading

_{Reviews (4): Last reviewed commit: "temperpaw: redirect GET/HEAD / to /dashb..." | Re-trigger Greptile}

[JacobHayes]

Not sure you prefer PRs or if you're adopting prompts-in-issues approach. :)