From 17ded3618be37ceb825f61884f382780888e2c1e Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Sun, 26 Apr 2026 07:58:53 -0500
Subject: [PATCH] fix: allow signup wizard steps through middleware for
 authenticated users

---
 proxy.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/proxy.ts b/proxy.ts
index 039aeea..2279c5b 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -17,6 +17,16 @@ export async function proxy(req: NextRequest) {
         return NextResponse.next()
     }
 
+    // Allow authenticated users to complete the signup wizard.
+    // After signUp.email() creates a session, the wizard needs to stay
+    // on /signup to complete OTP verification and passkey setup.
+    if (path === "/signup") {
+        const step = req.nextUrl.searchParams.get("step")
+        if (step === "otp" || step === "passkey") {
+            return NextResponse.next()
+        }
+    }
+
     // Validate session server-side instead of just checking cookie existence.
     // This prevents stale cookies from causing redirect loops.
     const session = await auth.api.getSession({