fix: Propagate public visibility to nested children in registerPublicRoute

[Alexandre Asselin (alexasselin008)]

Fix issue #607

registerPublicRoute only stamped $visibility: "public" on the top-level route. Nested children with no explicit $visibility fell through to the protected default and ended up under the wrong outlet. A new applyPublicVisibilityToChildren helper now walks the route tree recursively, stamping $visibility: "public" on each descendant while preserving any child that declares its own visibility.

Consumer impact

Audited all registerPublicRoute call sites across the Workleap org (gh search code 'registerPublicRoute' --owner workleap). No production consumer is behaviorally affected by this change. Every call site falls into one of three categories:

• No children passed — the recursive descent is a no-op. Covers most calls (path: "*", /login, /logout, etc.).
• children: [PublicRoutes] — the PublicRoutes outlet placeholder already declares $visibility: "public", so the recursive apply is a no-op. Used by wl-app's shell and wlp-performance-app's shell.
• False-positive name matches — sg-protect-web's local registerPublicRoutes helper (plural) returns a Route[] consumed by runtime.registerRoute, not the squide API.

This fix is therefore a pre-emptive correction for the hypothetical pattern "public route with non-placeholder nested children," which no consumer currently uses.

Audited repos: wl-app, sg-protect-web, wlp-performance-app, wlp-platform-widgets, wl-agents-code-review-poc.

[pkg-pr-new]

Open in StackBlitz

@squide/core

pnpm add https://pkg.pr.new/@squide/core@608

@squide/env-vars

pnpm add https://pkg.pr.new/@squide/env-vars@608

@squide/fakes

pnpm add https://pkg.pr.new/@squide/fakes@608

@squide/firefly

pnpm add https://pkg.pr.new/@squide/firefly@608

@squide/firefly-module-federation

pnpm add https://pkg.pr.new/@squide/firefly-module-federation@608

@squide/firefly-rsbuild-configs

pnpm add https://pkg.pr.new/@squide/firefly-rsbuild-configs@608

@squide/firefly-storybook

pnpm add https://pkg.pr.new/@squide/firefly-storybook@608

@squide/firefly-webpack-configs

pnpm add https://pkg.pr.new/@squide/firefly-webpack-configs@608

@squide/i18next

pnpm add https://pkg.pr.new/@squide/i18next@608

@squide/launch-darkly

pnpm add https://pkg.pr.new/@squide/launch-darkly@608

@squide/msw

pnpm add https://pkg.pr.new/@squide/msw@608

@squide/react-router

pnpm add https://pkg.pr.new/@squide/react-router@608

commit: f15f8b5

[Copilot]

Pull request overview

Fixes issue #607 where registerPublicRoute only marked the top-level route as public, causing nested children without an explicit $visibility to default to "protected" and be routed under the wrong outlet.

Changes:

• Added recursive stamping of $visibility: "public" to nested children when using registerPublicRoute, preserving any explicit child $visibility.
• Added targeted tests to validate flat, nested, and deeply nested public route registration behavior.
• Added a changeset to publish patch releases for the affected packages.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
packages/react-router/src/ReactRouterRuntime.ts	Recursively applies public visibility to nested children during registerPublicRoute.
packages/react-router/tests/ReactRouterRuntime.test.tsx	Adds coverage for registerPublicRoute behavior with nested routes and explicit child visibility.
.changeset/cozy-routes-inherit.md	Declares patch releases and documents the fix.