🐛(frontend) redirect homepage to login when homepage feat is disabled

FRONTEND_HOMEPAGE_FEATURE_ENABLED=false makes the Auth guard send
anonymous visitors on / straight to login instead of /home, but the
/home page itself still rendered the full homepage when reached via a
direct link. Redirect it to login too, so disabling the feature really
disables the page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PhqB4SHsHCuMfprwLEN3rR
Signed-off-by: Maarten Draijer <maarten@madra.nl>

CHANGELOG.md

@@ -11,6 +11,10 @@ and this project adheres to
 - ♿️(frontend) restore skip to content link after header redesign #2510
 - 🌐(i18n) rename cn_CN to zh_CN, add eo_PL and zh_TW locales #2486
 
+### Fixed
+
+- 🐛(frontend) redirect homepage to login when homepage feat is disabled #2521
+
 ## [v5.4.1] - 2026-07-09
 
 ### Changed

src/frontend/apps/e2e/__tests__/app-impress/home.spec.ts

@@ -178,4 +178,34 @@ test.describe('Home page', () => {
       page.locator(`${process.env.SIGN_IN_EL_LOGIN_PAGE}`).getByText('impress'),
     ).toBeVisible();
   });
+
+  test('it redirects a direct /home link to login when the homepage feature is disabled', async ({
+    page,
+  }) => {
+    await overrideConfig(page, {
+      FRONTEND_HOMEPAGE_FEATURE_ENABLED: false,
+    });
+
+    await page.goto('/home/');
+
+    // Keyclock login page
+    await expect(
+      page.locator(`${process.env.SIGN_IN_EL_LOGIN_PAGE}`).getByText('impress'),
+    ).toBeVisible();
+  });
+
+  test('it shows the homepage for a direct /home link when the homepage feature is enabled', async ({
+    page,
+  }) => {
+    await overrideConfig(page, {
+      FRONTEND_HOMEPAGE_FEATURE_ENABLED: true,
+    });
+
+    await page.goto('/home/');
+
+    // Homepage content, not the login page
+    await expect(
+      page.locator('h2').getByText('Govs ❤️ Open Source.'),
+    ).toBeVisible();
+  });
 });

src/frontend/apps/impress/src/pages/home/index.tsx

@@ -4,14 +4,18 @@ import { useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { Loading } from '@/components';
-import { useAuth } from '@/features/auth';
+import { useConfig } from '@/core';
+import { gotoLogin, useAuth } from '@/features/auth';
 import { HomeContent } from '@/features/home';
 import { NextPageWithLayout } from '@/types/next';
 
 const Page: NextPageWithLayout = () => {
   const { t } = useTranslation();
-  const { authenticated } = useAuth();
+  const { authenticated, isAuthLoading } = useAuth();
+  const { data: config, isFetched: isConfigFetched } = useConfig();
   const { replace } = useRouter();
+  const homepageDisabled =
+    isConfigFetched && !config?.FRONTEND_HOMEPAGE_FEATURE_ENABLED;
 
   /**
    * If the user is authenticated we redirect him to the index page (grid).
@@ -24,7 +28,21 @@ const Page: NextPageWithLayout = () => {
     void replace('/');
   }, [authenticated, replace]);
 
-  if (authenticated) {
+  /**
+   * If the homepage feature is disabled, the homepage should not be reachable
+   * even from a direct link, so we redirect the user to the login page — the
+   * same behavior as visiting `/` (see the `Auth` component). We wait for the
+   * config to be fetched so a pending flag is not mistaken for a disabled one.
+   */
+  useEffect(() => {
+    if (isAuthLoading || authenticated || !homepageDisabled) {
+      return;
+    }
+
+    gotoLogin(false);
+  }, [isAuthLoading, authenticated, homepageDisabled]);
+
+  if (isAuthLoading || authenticated || !isConfigFetched || homepageDisabled) {
     return <Loading $height="100vh" $width="100vw" />;
   }