From 872923dba2574324fd94bcc9f067268ca148eb7d Mon Sep 17 00:00:00 2001 From: Krystie Date: Fri, 24 Jul 2026 02:33:29 -0700 Subject: [PATCH] fix(auth): route /api/auth/sso-exchange through the v1 rewrite shim Caddy handle_path /dashcaddy-api/* only strips the /dashcaddy-api prefix, so the login-page fetch to /dashcaddy-api/api/auth/sso-exchange arrived at the app as /api/auth/sso-exchange - one path segment short of the canonical /api/v1/auth/sso-exchange mount, so it 404d (masked by isPublicRoute never even being reached). Add it to the same narrow gate/app-token rewrite case. Caught by an end-to-end curl replay of the actual handoff flow before asking for another live retest. --- dashcaddy-api/src/app.js | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js index 3285416..539ca90 100644 --- a/dashcaddy-api/src/app.js +++ b/dashcaddy-api/src/app.js @@ -217,15 +217,23 @@ async function createApp() { // /api/v1/auth/app-token/ -> /api/v1/auth/app-token/ (drift) // /api/auth/totp/check-session -> /api/v1/totp/check-session (mounted at /totp/check-session — no /auth prefix) // /api/v1/auth/totp/check-session->/api/v1/totp/check-session (drift) + // /api/auth/sso-exchange -> /api/v1/auth/sso-exchange (mounted at /auth/sso-exchange, same shape as gate/app-token) // // The totp case drops `/auth` because the canonical route is /totp/check-session // (no /auth prefix) but the legacy JS still uses /api/auth/totp/check-session // (and a stale-browser version of the page uses /api/v1/auth/totp/check-session). // Without these rewrites the JS gets a 404 and the page hangs at // "Signing in to Plex..." forever (user-reported 2026-07-09). + // + // sso-exchange added 2026-07-24: same Caddy handle_path /dashcaddy-api/* + // strips only the /dashcaddy-api prefix, so the login-page JS's fetch to + // /dashcaddy-api/api/auth/sso-exchange arrives here as /api/auth/sso-exchange + // — needs the same rewrite as gate/app-token, not the check-session one + // (this route's canonical mount already includes /auth/). app.use((req, res, next) => { if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/v1/auth/gate/') - || req.url.startsWith('/api/auth/app-token/') || req.url.startsWith('/api/v1/auth/app-token/')) { + || req.url.startsWith('/api/auth/app-token/') || req.url.startsWith('/api/v1/auth/app-token/') + || req.url.startsWith('/api/auth/sso-exchange')) { req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4 } else if (req.url.startsWith('/api/auth/totp/check-session')) { // Legacy: /api/auth/totp/check-session -> /api/v1/totp/check-session