Time‑Based Public Access for the /tv Route in a Next.js App
TL;DR: I added a temporal gate that lets anyone hit /tv without a session cookie between 9 am‑6 pm America/Cancun. Outside that window the request falls back to the normal auth middleware. The change lives in src/lib/auth.ts and src/middleware.ts and required proper timezone handling and a tiny refactor of the auth flow.
The Problem
Our TV dashboard (/tv) is meant to be displayed on a wall screen in the office lobby. The screen should be visible to anyone during office hours, but it must stay protected after hours. The original middleware (src/middleware.ts) forced a session cookie (AUTH_COOKIE_NAME) on all routes, including /tv. The result was a “401 Unauthorized” on the lobby screen after 6 pm, which broke the intended user experience.
The symptom was simple:
