User drop off issue

[Arhum2]

Problem

Users are dropping off when they hit the login wall while trying to browse listings. The current flow forces account creation before any value is shown:

Home page → "Browse Listings" → /discover → ProtectedRoute → /login

This hard gate prevents casual visitors from experiencing the product before committing to sign up.

Root Cause

• /discover is wrapped in <ProtectedRoute> and guarded by middleware.ts
• Backend /api/recommendations uses require_user_token (mandatory auth dependency)
• There is no middle ground between fully signed up and no access

Proposed Solution: Soft Conversion Funnel

Allow users to browse listings as a guest, then prompt for signup at natural conversion moments.

Guest Flow

1. User clicks "Browse Listings" → lightweight preference picker (location + price, no account needed)
2. Preferences stored in sessionStorage as guest_preferences
3. /discover renders for guests using those temporary prefs
4. Guest can swipe/browse freely
5. On like/save: soft signup modal — "Create a free account to save this listing"
6. After 5 swipes: nudge banner — "Sign up to keep your matches"
7. On signup: guest preferences are preserved and carried over automatically

Implementation Scope

Layer	Change
middleware.ts	Add /discover to public routes
ProtectedRoute	Remove from /discover page
preferences-setup/page.jsx	Allow without auth, save to sessionStorage for guests
discover/page.jsx	Handle guest state, intercept like action, show nudge after 5 swipes
recommendations.py	Make auth optional; accept city/min_price/max_price query params as fallback
AuthContext.jsx	Expose isGuest boolean

Acceptance Criteria

• Unauthenticated users can reach /discover without being redirected to /login
• Guest preference picker works on /preferences-setup without an account
• Guest preferences persist in sessionStorage across the session
• Recommendations load for guests using temporary preferences
• Liking a listing as a guest shows a signup prompt instead of saving
• A soft nudge appears after 5 guest swipes
• Completing signup as a guest carries over their selected preferences
• Authenticated flow is unchanged

Notes

• Do not persist guest swipe data server-side in this iteration — keep it stateless
• Guest session scoped to sessionStorage only (cleared on tab close)
• Backend dependencies/auth.py already has get_user_token() (optional variant) — use that instead of require_user_token()