# Move index.html to /landing

**Date:** 2025-12-03
**Status:** Approved
**Branch:** `feature/remove-index-html`

## Context

The original requirement was to serve `index.html` at the root of the application. This has since changed:

- The app runs at `amsoil-dlp.acdev3.com` (dev/staging)
- The marketing landing page lives separately at `amsoil.aimclear.com`
- The current `app/page.tsx` reads `index.html` and injects it via raw HTML injection (flagged as XSS risk in code review)

The landing page is only needed in dev/staging for QA testing of the registration flow (accessing the 4 subscribe buttons).

## Decision

1. **Root `/`** becomes an auth-aware redirect:
   - Authenticated users → `/dashboard`
   - Unauthenticated users → `/api/auth/signin`

2. **Landing page** moves to `/landing`:
   - `index.html` → `public/landing/index.html`
   - Accessible in all environments (no harm if found in production)

3. **No impact on OAuth or Stripe:**
   - All API routes unchanged (`/api/auth/callback/*`, `/api/webhooks/stripe`)
   - External service configurations remain valid

## Implementation

### Files to Change

| File | Change |
|------|--------|
| `app/page.tsx` | Replace file-reading logic with auth redirect |
| `index.html` | Move to `public/landing/index.html` |
| `CLAUDE.md` | Update constraint documentation |
| `docs/REGISTRATION_FLOW_MAP.md` | Update references |
| `OAUTH_IMPLEMENTATION.md` | Update references |

### New `app/page.tsx`

```tsx
import { redirect } from 'next/navigation';
import { getServerSession } from 'next-auth/next';
import { authOptions } from '@/lib/auth';

export default async function RootPage() {
  const session = await getServerSession(authOptions);

  if (session?.user) {
    redirect('/dashboard');
  } else {
    redirect('/api/auth/signin');
  }
}
```

### File Move

```
Before: /index.html
After:  /public/landing/index.html
URL:    /landing/index.html (or /landing/ with trailing slash)
```

## Future Architecture Compatibility

This change is compatible with a future reverse proxy setup where:

```
amsoil.aimclear.com/           → Static landing (LiquidWeb)
amsoil.aimclear.com/dashboard/ → Next.js app
amsoil.aimclear.com/api/       → Next.js app
```

In that setup, requests to `/` never reach the Next.js app, making our root redirect irrelevant for production while useful for direct dev/staging access.

## What We're NOT Doing

- Converting HTML to React (not worth it for QA-only page)
- Adding middleware to gate `/landing` by environment
- Changing Stripe integration (already env-var based)
- Changing any API routes

## Verification

After implementation:
1. Visit `/` while signed out → should redirect to sign-in
2. Visit `/` while signed in → should redirect to dashboard
3. Visit `/landing/` → should show the marketing page with subscribe buttons
4. Click subscribe button → should trigger checkout flow normally