From 5217dd4fcad53d8b1fbe0e88013f9691bc5b36af Mon Sep 17 00:00:00 2001
From: Maarten Draijer <maarten@madra.nl>
Date: Sun, 12 Jul 2026 18:47:06 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B(frontend)=20redirect=20homepage=20?=
 =?UTF-8?q?to=20login=20when=20homepage=20feat=20is=20disabled?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

FRONTEND_HOMEPAGE_FEATURE_ENABLED=false makes the Auth guard send
anonymous visitors on / straight to login instead of /home, but the
/home page itself still rendered the full homepage when reached via a
direct link. Redirect it to login too, so disabling the feature really
disables the page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PhqB4SHsHCuMfprwLEN3rR
Signed-off-by: Maarten Draijer <maarten@madra.nl>
---
 CHANGELOG.md                                  |  4 +++
 .../e2e/__tests__/app-impress/home.spec.ts    | 30 +++++++++++++++++++
 .../apps/impress/src/pages/home/index.tsx     | 24 +++++++++++++--
 3 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23fe41bc6..8b1fc3fde 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@ and this project adheres to
 - ♿️(frontend) restore skip to content link after header redesign #2510
 - 🌐(i18n) rename cn_CN to zh_CN, add eo_PL and zh_TW locales #2486
 
+### Fixed
+
+- 🐛(frontend) redirect homepage to login when homepage feat is disabled #2521
+
 ## [v5.4.1] - 2026-07-09
 
 ### Changed
diff --git a/src/frontend/apps/e2e/__tests__/app-impress/home.spec.ts b/src/frontend/apps/e2e/__tests__/app-impress/home.spec.ts
index 3c9e8649b..1593b14e3 100644
--- a/src/frontend/apps/e2e/__tests__/app-impress/home.spec.ts
+++ b/src/frontend/apps/e2e/__tests__/app-impress/home.spec.ts
@@ -178,4 +178,34 @@ test.describe('Home page', () => {
       page.locator(`${process.env.SIGN_IN_EL_LOGIN_PAGE}`).getByText('impress'),
     ).toBeVisible();
   });
+
+  test('it redirects a direct /home link to login when the homepage feature is disabled', async ({
+    page,
+  }) => {
+    await overrideConfig(page, {
+      FRONTEND_HOMEPAGE_FEATURE_ENABLED: false,
+    });
+
+    await page.goto('/home/');
+
+    // Keyclock login page
+    await expect(
+      page.locator(`${process.env.SIGN_IN_EL_LOGIN_PAGE}`).getByText('impress'),
+    ).toBeVisible();
+  });
+
+  test('it shows the homepage for a direct /home link when the homepage feature is enabled', async ({
+    page,
+  }) => {
+    await overrideConfig(page, {
+      FRONTEND_HOMEPAGE_FEATURE_ENABLED: true,
+    });
+
+    await page.goto('/home/');
+
+    // Homepage content, not the login page
+    await expect(
+      page.locator('h2').getByText('Govs ❤️ Open Source.'),
+    ).toBeVisible();
+  });
 });
diff --git a/src/frontend/apps/impress/src/pages/home/index.tsx b/src/frontend/apps/impress/src/pages/home/index.tsx
index fda21647f..742535866 100644
--- a/src/frontend/apps/impress/src/pages/home/index.tsx
+++ b/src/frontend/apps/impress/src/pages/home/index.tsx
@@ -4,14 +4,18 @@ import { useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { Loading } from '@/components';
-import { useAuth } from '@/features/auth';
+import { useConfig } from '@/core';
+import { gotoLogin, useAuth } from '@/features/auth';
 import { HomeContent } from '@/features/home';
 import { NextPageWithLayout } from '@/types/next';
 
 const Page: NextPageWithLayout = () => {
   const { t } = useTranslation();
-  const { authenticated } = useAuth();
+  const { authenticated, isAuthLoading } = useAuth();
+  const { data: config, isFetched: isConfigFetched } = useConfig();
   const { replace } = useRouter();
+  const homepageDisabled =
+    isConfigFetched && !config?.FRONTEND_HOMEPAGE_FEATURE_ENABLED;
 
   /**
    * If the user is authenticated we redirect him to the index page (grid).
@@ -24,7 +28,21 @@ const Page: NextPageWithLayout = () => {
     void replace('/');
   }, [authenticated, replace]);
 
-  if (authenticated) {
+  /**
+   * If the homepage feature is disabled, the homepage should not be reachable
+   * even from a direct link, so we redirect the user to the login page — the
+   * same behavior as visiting `/` (see the `Auth` component). We wait for the
+   * config to be fetched so a pending flag is not mistaken for a disabled one.
+   */
+  useEffect(() => {
+    if (isAuthLoading || authenticated || !homepageDisabled) {
+      return;
+    }
+
+    gotoLogin(false);
+  }, [isAuthLoading, authenticated, homepageDisabled]);
+
+  if (isAuthLoading || authenticated || !isConfigFetched || homepageDisabled) {
     return <Loading $height="100vh" $width="100vw" />;
   }