🔴 [P0] Critical Security Flaw: Unauthenticated Users Can Access Any Protected Route in AppRouter
A critical security vulnerability has been exposed in the application's core routing logic. The `AppRouter` currently lacks any authentication guard middleware, effectively leaving all protected routes open to unauthenticated users. This is not a minor oversight but a fundamental architectural flaw, as the router remains a stub implementation. The absence of this guard means any user, logged in or not, can navigate directly to screens containing sensitive or protected data, bypassing the login flow entirely.
The vulnerability is located in the `lib/core/routing/app_router.dart` file. The proposed fix involves implementing a route guard that leverages the `ObserveAuthStateUseCase` to intercept navigation attempts. The guard must check the user's authentication state before resolving any route. For unauthenticated users, the router should redirect to the `LoginScreen`. A separate check is also required for users with archived accounts, who should be directed to an `ArchivedAccountScreen`. This pattern is standard for securing client-side navigation but is currently missing.
The impact is severe and unambiguous: this is a security vulnerability that renders protected data screens accessible without any form of login. It compromises the basic integrity of the application's access control, posing a direct risk to user data privacy and system security. The issue is classified as a P0—the highest priority—demanding immediate remediation to prevent potential data exposure.