From c744bee9dca85e5d4df77c2d23aae6a40cf1d187 Mon Sep 17 00:00:00 2001
From: neodk2004 <barac.daniel@gmail.com>
Date: Tue, 21 Jul 2026 21:09:22 +0200
Subject: [PATCH] fix(cron): exempt /api/cron/* from Clerk auth.protect()

trim-feeds and anniversaries validate their own CRON_SECRET bearer
token, but Clerk's middleware ran auth.protect() first and 307-redirected
every request (including the cron caller) to sign-in before the route
handler's own check ever ran. Same pattern as /api/webhooks/(.*), which
also authenticates itself independently of Clerk.
---
 src/proxy.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/proxy.ts b/src/proxy.ts
index 767e094..29cece7 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -14,6 +14,7 @@ const isPublicRoute = createRouteMatcher([
   "/join(.*)",
   "/api/webhooks/(.*)",
   "/api/auth/(.*)",
+  "/api/cron/(.*)",
 ]);
 
 export default clerkMiddleware(async (auth, request) => {