Middleware compared request.nextUrl.pathname (basePath already stripped by Next.js) against paths still prefixed with /shop, so /shop/admin pages loaded without server-side auth protection. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Middleware compared request.nextUrl.pathname (basePath already stripped by Next.js) against paths still prefixed with /shop, so /shop/admin pages loaded without server-side auth protection. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>