fix: Add /profile to protected routes, comprehensive DEPLOY.md

- Add /:locale/profile to clerkMiddleware protected routes
- Update DEPLOY.md with complete env var reference for Vercel + HF Spaces
- Add architecture diagram, smoke test steps, troubleshooting section
- Security checklist for production deployment

DEPLOY.md

@@ -4,264 +4,274 @@
 
 ---
 
-## Honest Time Estimate
+## Architecture Overview
 
-| Milestone | Time |
-|---|---|
-| Clerk setup (Google OAuth) + env vars | **10 min** |
-| Neon Postgres + run migrations | **10 min** |
-| Frontend on Vercel | **5 min** |
-| API + Worker on Hugging Face Spaces | **20–30 min** |
-| Wire frontend → backend + smoke test | **10 min** |
-| **Running frontend + API + Worker + DB + Google Auth** | **~1 hour** (if everything goes smoothly) |
+```
+┌─────────────────────────┐         ┌──────────────────────────────────────────┐
+│   Vercel (Next.js 15)   │────────▶│   Hugging Face Spaces (Docker)           │
+│   - Clerk auth          │  HTTPS  │   - NestJS API + Inngest Worker          │
+│   - Hero page           │         │   - Port 7860                            │
+│   - Profile page        │         │                                            │
+│   - Mission dashboard   │         │   /api/*  → API routes                  │
+│   - Static assets       │         │   /api/inngest → Worker functions        │
+└─────────────────────────┘         └────────────────────┬─────────────────────┘
+                                                         │
+                                                         │  postgres://...
+                                                         ▼
+                                            ┌────────────────────────────┐
+                                            │   Neon Postgres (Cloud)    │
+                                            │   - 55 tables              │
+                                            │   - pgvector + FTS         │
+                                            │   - Legal chunks seeded    │
+                                            └────────────────────────────┘
+```
 
 ---
 
 ## Prerequisites
 
-- GitHub repo pushed and public (or HF Pro for private Spaces)
-- Accounts (all have generous free tiers):
-  - [Vercel](https://vercel.com)
-  - [Clerk](https://clerk.com)
-  - [Hugging Face](https://huggingface.co)
-  - [Neon](https://neon.tech)
-  - [Inngest](https://inngest.com) (optional — for background workflows)
-- OpenRouter API key (or OpenCode / OpenAI key) for LLM calls
+| Service | Purpose | Free Tier |
+|---------|---------|-----------|
+| [Vercel](https://vercel.com) | Frontend hosting | Hobby (unlimited) |
+| [Clerk](https://clerk.com) | Auth + Google OAuth | 10,000 MAU |
+| [Hugging Face Spaces](https://huggingface.co/spaces) | Backend API + Worker | CPU Basic (free) |
+| [Neon](https://neon.tech) | Postgres database | 500 MB, 200 hrs |
+| [Inngest](https://inngest.com) | Background workflows | 50k events/mo |
+| [OpenRouter](https://openrouter.ai) | LLM API | $5 free credits |
 
 ---
 
 ## Step 1: Clerk + Google OAuth (10 min)
 
 1. Go to [dashboard.clerk.com](https://dashboard.clerk.com) → Create Application.
-2. In the **Social Connections** section, enable **Google**.
-   - For development, use Clerk's shared OAuth credentials (just toggle it on).
-   - For production, add your own Google Client ID/Secret.
-3. Copy your **Publishable Key** and **Secret Key** from Clerk Dashboard → API Keys.
-4. Set these in Vercel (Step 3) and locally:
-   ```
-   NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
-   CLERK_SECRET_KEY=sk_test_...
-   NEXT_PUBLIC_CLERK_SIGN_IN_URL=/en/sign-in
-   NEXT_PUBLIC_CLERK_SIGN_UP_URL=/en/sign-up
-   ```
-5. That's it — the frontend has Clerk wired with `SignInButton`, `UserButton`, and `<Show when="signed-in">` components.
-6. **Backend Clerk verification:** The API verifies Clerk JWTs from the `Authorization: Bearer <token>` header. On first API call, it auto-creates a user in the DB and links their Google identity.
+2. **Social Connections** → enable **Google**.
+   - Development: toggle on (uses Clerk's shared OAuth credentials).
+   - Production: add your own Google Client ID/Secret.
+3. Copy keys from **API Keys** tab:
+   - `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...`
+   - `CLERK_SECRET_KEY=sk_test_...`
+4. Add your Vercel domain to **URLs** → **Allowed Origins**:
+   - `https://your-project.vercel.app`
+   - `http://localhost:3000` (for local dev)
 
 ---
 
 ## Step 2: Neon Postgres (10 min)
 
-1. Go to [neon.tech](https://neon.tech) → New Project → copy the **connection string**.
-2. Save it as `DATABASE_URL` and `DIRECT_DATABASE_URL`.
-3. **Run migrations** against the Neon DB:
+1. [neon.tech](https://neon.tech) → New Project → copy **connection string**.
+2. Run migrations from your local machine:
    ```bash
-   # At repo root
-   export DATABASE_URL="postgres://..."
-   export DIRECT_DATABASE_URL="postgres://..."
+   export DATABASE_URL="postgres://courtmitra:password@host.neon.tech/courtmitra"
+   export DIRECT_DATABASE_URL="$DATABASE_URL"
    pnpm db:migrate
    pnpm db:seed
    ```
+3. Verify: check that `users`, `missions`, `route_rules`, `legal_chunks` tables exist.
 
 ---
 
 ## Step 3: Frontend → Vercel (5 min)
 
-1. Push this repo to GitHub.
-2. In Vercel → **Add New Project** → import the repo.
-3. Set these **Environment Variables** in the Vercel dashboard:
-   ```
-   NEXT_PUBLIC_API_BASE_URL=https://your-hf-space.hf.space/api
-   NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
-   CLERK_SECRET_KEY=sk_test_...
-   NEXT_PUBLIC_CLERK_SIGN_IN_URL=/en/sign-in
-   NEXT_PUBLIC_CLERK_SIGN_UP_URL=/en/sign-up
-   ```
-4. Deploy. Vercel will auto-detect Next.js in `apps/web`.
+1. Push repo to GitHub.
+2. Vercel → **Add New Project** → import repo.
+3. Set **Environment Variables**:
 
-> **Tip:** `next.config.mjs` already has `output: "standalone"`, so Vercel optimizes automatically.
+   | Variable | Value | Notes |
+   |----------|-------|-------|
+   | `NEXT_PUBLIC_API_BASE_URL` | `https://your-hf-space.hf.space/api` | Your HF Spaces URL |
+   | `INTERNAL_API_BASE_URL` | `https://your-hf-space.hf.space/api` | Same as above |
+   | `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` | `pk_test_...` | From Clerk dashboard |
+   | `CLERK_SECRET_KEY` | `sk_test_...` | From Clerk dashboard |
+   | `NEXT_PUBLIC_CLERK_SIGN_IN_URL` | `/en/sign-in` | Or `/hi/sign-in` |
+   | `NEXT_PUBLIC_CLERK_SIGN_UP_URL` | `/en/sign-up` | Or `/hi/sign-up` |
 
----
+4. Deploy.
 
-## Step 4: Backend → Hugging Face Spaces (25 min)
+---
 
-### 4a. Create the Space
+## Step 4: Backend → Hugging Face Spaces (20 min)
 
-1. Go to [huggingface.co/spaces](https://huggingface.co/spaces) → **Create new Space**.
+### 4a. Create Space
+1. [huggingface.co/spaces](https://huggingface.co/spaces) → **Create new Space**.
 2. **Space name:** `courtmitra-api`
 3. **SDK:** `Docker`
-4. **Visibility:** Public (free tier)
+4. **Visibility:** Public
 5. **Hardware:** Free CPU
 
-### 4b. Deploy the Dockerfile
-
-The repo root has `Dockerfile.hf` which builds the monorepo and runs the NestJS API + Inngest Worker in ONE container.
+### 4b. Link GitHub Repo
+In Space Settings → **Repository** → link your GitHub repo.
 
-Push it to HF (or link your GitHub repo in HF Space settings):
-
-```bash
-git add Dockerfile.hf
-git commit -m "Add HF Spaces Dockerfile (API + Worker combined)"
-git push origin main
-```
-
-Then in your HF Space → **Settings** → **Repository** → link your GitHub repo.
+The `Dockerfile.hf` at repo root builds the monorepo and runs API + Worker in one container.
 
 ### 4c. Set Environment Variables
 
-In your HF Space → **Settings** → **Variables & Secrets**:
+In Space → **Settings** → **Variables & Secrets**:
 
+#### Required (App won't start without these)
 ```
 PORT=7860
 API_PORT=7860
-DATABASE_URL=postgres://... (Neon)
-DIRECT_DATABASE_URL=postgres://... (Neon)
+DATABASE_URL=postgres://courtmitra:password@host.neon.tech/courtmitra
+DIRECT_DATABASE_URL=postgres://courtmitra:password@host.neon.tech/courtmitra
+APP_BASE_URL=https://your-hf-space.hf.space
+API_BASE_URL=https://your-hf-space.hf.space
+WEBHOOK_BASE_URL=https://your-hf-space.hf.space
+JWT_SECRET=change-me-32-chars-minimum!!
+PII_HASH_SALT=change-me-salt
+TOKEN_ENCRYPTION_KEY=change-me-32-chars-minimum!!
+```
+
+#### Required for AI (Intake, route-plan, evidence parsing)
+```
 AI_PROVIDER=openrouter
 OPENROUTER_API_KEY=sk-or-v1-...
 AI_MODEL=google/gemini-2.0-flash-exp:free
 AI_VISION_MODEL=google/gemini-2.0-flash-exp:free
-APP_BASE_URL=https://your-hf-space.hf.space
-API_BASE_URL=https://your-hf-space.hf.space
-WEBHOOK_BASE_URL=https://your-hf-space.hf.space
-LOCAL_STORAGE_DIR=/app/.storage
-JWT_SECRET=hackathon-jwt-secret-change-me
-PII_HASH_SALT=hackathon-salt
-TOKEN_ENCRYPTION_KEY=hackathon-enc-key-min-32-chars!!
+```
+
+#### Clerk (for JWT verification)
+```
 CLERK_SECRET_KEY=sk_test_...
-CLERK_JWT_KEY=... (optional — for networkless JWT verification)
+# Optional: for networkless JWT verification (faster, no Clerk API call per request)
+CLERK_JWT_KEY=...
+# Optional: restrict which domains can use your API
+CLERK_AUTHORIZED_PARTIES=https://your-project.vercel.app,http://localhost:3000
 ```
 
-Optional (for email actions):
+#### Optional (Email actions — Resend)
 ```
 RESEND_API_KEY=re_...
 RESEND_FROM=noreply@yourdomain.com
 ```
 
-Optional (for Inngest background workflows):
+#### Optional (Inngest background workflows)
 ```
-INNGEST_EVENT_KEY=... (from Inngest Cloud)
-INNGEST_SIGNING_KEY=... (from Inngest Cloud)
+INNGEST_EVENT_KEY=...
+INNGEST_SIGNING_KEY=...
 INNGEST_BASE_URL=https://api.inngest.com
 ```
 
-Optional (for local dev without Clerk):
+#### Optional (Local dev helper — NOT for production)
 ```
 DEMO_MODE=true
 ```
+> ⚠️ **Never set `DEMO_MODE=true` in production.** It bypasses all auth.
 
-### 4d. Verify the API
-
-Once the Space builds, visit:
-- `https://your-space.hf.space/api/admin/health` → should return `{"status":"ok"}`
-- `https://your-space.hf.space/api/inngest` → should return the Inngest registration JSON
-
----
-
-## Step 5: Wire Frontend → Backend
-
-Update your Vercel environment variable:
+#### Optional (Object storage — for evidence files)
 ```
-NEXT_PUBLIC_API_BASE_URL=https://your-hf-space.hf.space/api
+OBJECT_STORAGE_ENDPOINT=https://...
+OBJECT_STORAGE_BUCKET=courtmitra
+OBJECT_STORAGE_ACCESS_KEY=...
+OBJECT_STORAGE_SECRET_KEY=...
 ```
-Redeploy the frontend (or Vercel will auto-redeploy on save).
+> If not set, evidence files are stored locally in `/app/.storage` (lost on Space restart).
 
----
-
-## Architecture (Combined Container)
+#### Optional (Other channels)
+```
+WHATSAPP_VERIFY_TOKEN=...
+WHATSAPP_APP_SECRET=...
+WHATSAPP_ACCESS_TOKEN=...
+WHATSAPP_PHONE_NUMBER_ID=...
+TELEGRAM_BOT_TOKEN=...
+```
 
+#### Optional (Phase 2 features — not needed for hackathon)
 ```
-┌─────────────────────────────────────────────────┐
-│         Hugging Face Spaces — Port 7860          │
-│  ┌─────────────────────────────────────────┐     │
-│  │      Fastify HTTP Server (NestJS)       │     │
-│  │  ┌─────────────┐    ┌────────────────┐  │     │
-│  │  │ API Routes  │    │ /api/inngest   │  │     │
-│  │  │ /api/*      │    │ (Worker Fns)   │  │     │
-│  │  │             │    │                │  │     │
-│  │  │ - missions  │    │ - intake       │  │     │
-│  │  │ - actions   │    │ - evidence     │  │     │
-│  │  │ - users     │    │ - route-plan   │  │     │
-│  │  │ - evidence  │    │ - execute      │  │     │
-│  │  └─────────────┘    └────────────────┘  │     │
-│  └─────────────────────────────────────────┘     │
-│           ↓                                      │
-│      Neon Postgres (Cloud)                       │
-└─────────────────────────────────────────────────┘
+QDRANT_URL=https://...
+QDRANT_API_KEY=...
+QDRANT_COLLECTION=courtmitra_legal
+OPENAI_API_KEY=...
+BROWSERBASE_API_KEY=...
+BROWSERBASE_PROJECT_ID=...
+SUREPASS_API_KEY=...
+ENABLE_PORTAL_AUTOMATION=1
 ```
 
----
+### 4d. Verify
 
-## Quick Smoke Test
+Once built, test:
+```bash
+curl https://your-space.hf.space/api/admin/health
+# Expected: {"status":"ok","ts":"..."}
 
-After both are deployed:
+curl https://your-space.hf.space/api/capabilities
+# Expected: JSON with adapter capabilities
 
-1. Open your Vercel URL → click **Sign In** → choose **Google**.
-2. After signing in, you should see your avatar in the top-right corner.
-3. Click **Get Started** (hero CTA) → describe a problem.
-4. The API call should reach HF Spaces, create a user in the DB, and create a mission.
-5. Visit `/{locale}/profile` → you should see your profile and the mission you just created.
-6. Check `https://your-hf-space.hf.space/api/admin/health` to confirm backend is alive.
+curl https://your-space.hf.space/api/inngest
+# Expected: Inngest registration JSON
+```
 
 ---
 
-## New Features
+## Step 5: Wire Frontend → Backend
 
-| Feature | Status |
-|---|---|
-| Google OAuth via Clerk | ✅ Frontend + Backend verified |
-| User auto-creation on first API call | ✅ Creates `users` + `userIdentities` rows |
-| Profile page (`/{locale}/profile`) | ✅ Shows avatar, name, email, editable phone + language |
-| My Missions list on profile | ✅ Lists user's own missions |
-| Mission ownership | ✅ Users only see their own missions |
-| Combined API + Worker container | ✅ One HF Space serves both |
-| Demo mode | ✅ `DEMO_MODE=true` bypasses auth for local dev |
+1. In Vercel dashboard, update:
+   ```
+   NEXT_PUBLIC_API_BASE_URL=https://your-hf-space.hf.space/api
+   ```
+2. Redeploy frontend.
 
 ---
 
-## Known Limitations for Hackathon Demo
-
-| Feature | Status in 1-hour deploy |
-|---|---|
-| Frontend + Google OAuth on Vercel | ✅ Works |
-| API + Worker + DB on HF + Neon | ✅ Works |
-| Mission CRUD (user-scoped) | ✅ Works |
-| Evidence upload | ✅ Works (if storage configured) |
-| Background AI workflows | ⚠️ Needs Inngest Cloud keys for production webhooks |
-| Email sending via Resend | ⚠️ Needs Resend key + verified domain |
-| WhatsApp / Telegram channels | ❌ Needs Meta Business verification (days) |
-| Portal automation / eCourts | ❌ Phase 2 only |
+## Complete Environment Variable Reference
+
+### Vercel (Frontend)
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `NEXT_PUBLIC_API_BASE_URL` | ✅ | HF Spaces API URL |
+| `INTERNAL_API_BASE_URL` | ✅ | Same as above (for SSR) |
+| `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` | ✅ | Clerk public key |
+| `CLERK_SECRET_KEY` | ✅ | Clerk secret key |
+| `NEXT_PUBLIC_CLERK_SIGN_IN_URL` | ✅ | `/en/sign-in` |
+| `NEXT_PUBLIC_CLERK_SIGN_UP_URL` | ✅ | `/en/sign-up` |
+
+### Hugging Face Spaces (Backend)
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `PORT` | ✅ | Must be `7860` |
+| `API_PORT` | ✅ | Must be `7860` |
+| `DATABASE_URL` | ✅ | Neon connection string |
+| `DIRECT_DATABASE_URL` | ✅ | Same as `DATABASE_URL` |
+| `APP_BASE_URL` | ✅ | HF Spaces URL |
+| `API_BASE_URL` | ✅ | Same |
+| `WEBHOOK_BASE_URL` | ✅ | Same |
+| `JWT_SECRET` | ✅ | Min 32 chars |
+| `PII_HASH_SALT` | ✅ | Any string |
+| `TOKEN_ENCRYPTION_KEY` | ✅ | Min 32 chars |
+| `AI_PROVIDER` | ✅ | `openrouter` or `opencode` |
+| `OPENROUTER_API_KEY` | ✅ | If `AI_PROVIDER=openrouter` |
+| `AI_MODEL` | ✅ | e.g. `google/gemini-2.0-flash-exp:free` |
+| `AI_VISION_MODEL` | ✅ | e.g. `google/gemini-2.0-flash-exp:free` |
+| `CLERK_SECRET_KEY` | ✅ | Same as Vercel |
+| `CLERK_JWT_KEY` | ⬜ | Optional, for faster JWT verification |
+| `RESEND_API_KEY` | ⬜ | For email actions |
+| `RESEND_FROM` | ⬜ | Sender email |
+| `INNGEST_EVENT_KEY` | ⬜ | For background workflows |
+| `INNGEST_SIGNING_KEY` | ⬜ | For background workflows |
+| `LOCAL_STORAGE_DIR` | ⬜ | Defaults to `/app/.storage` |
+| `DEMO_MODE` | ⬜ | `true` = bypass auth (dev only!) |
 
 ---
 
-## Troubleshooting
-
-**HF Space build fails:**
-- Check **Factory Logs** in HF. If `pnpm` is missing, the Dockerfile installs it via `corepack`.
-- If out of disk: HF free tier has ~50GB disk. The Dockerfile removes frontend packages (`next`, `react`) from the API deploy to save space.
-
-**API returns 401 Unauthorized:**
-- Make sure `CLERK_SECRET_KEY` is set in HF Space env vars.
-- Make sure the frontend passes `Authorization: Bearer <token>` header. Check browser DevTools Network tab.
-
-**API returns 500:**
-- Verify `DATABASE_URL` is set and migrations ran.
-- Verify `OPENROUTER_API_KEY` is set (some endpoints call LLMs).
+## Quick Smoke Test
 
-**CORS errors from frontend:**
-- The API has `app.enableCors({ origin: true })` which reflects the request origin. If blocked, add your Vercel domain to `origin: ["https://your-vercel.app"]` in `apps/api/src/main.ts`.
+After deploying both services:
 
-**Clerk sign-in fails:**
-- Make sure `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` and `CLERK_SECRET_KEY` are set in Vercel.
-- In Clerk Dashboard → **Social Connections** → **Google**, ensure it's enabled.
-- Add your Vercel domain to Clerk Dashboard → **URLs** → **Allowed Origins**.
-
-**Inngest events not firing:**
-- Make sure `INNGEST_EVENT_KEY` and `INNGEST_SIGNING_KEY` are correct.
-- Check the Inngest Cloud dashboard for failed runs.
-- HF free-tier Spaces sleep after inactivity. Use a paid Space or keep-alive ping for reliable background processing.
+1. Open Vercel URL → click **Sign In** → choose **Google**.
+2. After signing in, you should see your avatar in the top-right.
+3. On the hero page, click **Get Started** → create a mission.
+4. Visit `/{locale}/profile` → you should see:
+   - Your Google name + email + avatar
+   - Editable phone number
+   - Language preference dropdown
+   - Your mission listed under "My Missions"
+5. The API calls should show `200 OK` in browser DevTools Network tab with `Authorization: Bearer <token>` header.
 
 ---
 
-## Local Dev
+## Local Development
 
 ```bash
 # 1. Start local Postgres + Inngest
@@ -269,6 +279,7 @@ pnpm infra:up
 
 # 2. Copy env and fill in keys
 cp infra/.env.example .env
+# Edit .env with your keys
 
 # 3. Run everything
 pnpm dev
@@ -278,7 +289,75 @@ pnpm dev
 - API: http://localhost:3001/api
 - Inngest Dev Server: http://localhost:8288
 
-**Note:** For local dev without Clerk, set `DEMO_MODE=true` in `.env`. The API will skip JWT verification and use a demo user.
+**For local dev without Clerk keys**, add to `.env`:
+```
+DEMO_MODE=true
+```
+
+---
+
+## Troubleshooting
+
+### HF Space build fails
+- Check **Factory Logs** in HF dashboard.
+- Common: `pnpm` not found → Dockerfile installs via `corepack`.
+- Common: out of disk → free tier has ~50GB. Dockerfile strips `next`/`react` packages.
+
+### API returns 401 Unauthorized
+- Make sure `CLERK_SECRET_KEY` is set in HF Space.
+- Make sure frontend sends `Authorization: Bearer <token>` header (check DevTools).
+- If testing with curl, you need a valid Clerk JWT token.
+
+### API returns 500
+- Check HF **Application Logs**.
+- Common: `DATABASE_URL` not set → can't connect to Neon.
+- Common: `OPENROUTER_API_KEY` not set → AI endpoints fail.
+- Common: `JWT_SECRET` too short → must be ≥32 characters.
+
+### CORS errors from frontend
+- API has `app.enableCors({ origin: true })` which reflects the request origin.
+- If still blocked, add your Vercel domain explicitly in `apps/api/src/main.ts`.
+
+### Clerk sign-in fails
+- Verify `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` and `CLERK_SECRET_KEY` are set in Vercel.
+- In Clerk Dashboard → **Social Connections** → **Google** must be enabled.
+- Add your Vercel domain to Clerk Dashboard → **URLs** → **Allowed Origins**.
+
+### Background workflows not running
+- HF free-tier Spaces **sleep after inactivity**. When the Space sleeps, Inngest can't invoke your worker.
+- **Fix:** Use a paid HF Space (Always On), or use Inngest's `serve` with a keep-alive ping.
+- Alternatively: trigger workflows manually via API for demo purposes.
+
+### Database connection errors
+- Neon databases have a **connection limit**. If you see "too many clients", restart the HF Space.
+- Use Neon's **connection pooling** (add `?pgbouncer=true` to connection string).
+
+---
+
+## Known Limitations
+
+| Feature | Status |
+|---------|--------|
+| Google OAuth + user profiles | ✅ Works |
+| Mission CRUD (user-scoped) | ✅ Works |
+| Evidence upload | ✅ Works (if storage configured) |
+| Background AI workflows | ⚠️ Needs Inngest + always-on Space |
+| Email sending | ⚠️ Needs Resend key |
+| WhatsApp/Telegram | ❌ Needs Meta Business verification (days) |
+| Portal automation | ❌ Phase 2 only |
+
+---
+
+## Security Checklist
+
+Before going live:
+- [ ] `DEMO_MODE` is NOT set (or set to `false`)
+- [ ] `JWT_SECRET` is ≥32 random characters
+- [ ] `TOKEN_ENCRYPTION_KEY` is ≥32 random characters
+- [ ] `CLERK_JWT_KEY` is set (optional but recommended for performance)
+- [ ] Database uses SSL (Neon does this by default)
+- [ ] HF Space is set to **private** if you don't want public API access
+- [ ] Vercel domain is in Clerk's **Allowed Origins**
 
 ---
 

apps/web/middleware.ts

@@ -7,6 +7,7 @@ const intlMiddleware = createMiddleware(routing);
 const isProtectedRoute = createRouteMatcher([
   "/:locale/ledger",
   "/:locale/missions(.*)",
+  "/:locale/profile",
 ]);
 
 export default clerkMiddleware(async (auth, req) => {