fix: match parameterized public auth routes

2026-07-21 21:59:03 -07:00
parent d9e61ce1b7
commit a2a2bee71e
3 changed files with 110 additions and 2 deletions
@@ -392,6 +392,17 @@ module.exports = function configureMiddleware(app, {
  function isPublicRoute(req) {
    return PUBLIC_ROUTES.some(r => {
      if (r.method && req.method !== r.method) return false;
+      if (r.exact) {
+        // Exact string match, BUT allow `:param` placeholders in the
+        // PUBLIC_ROUTES entry to match any single path segment. This was a
+        // pre-existing bug — literal ':token' never matched real tokens —
+        // caught by DC-053 public share preview returning 401.
+        if (r.path.includes(':')) {
+          const pattern = '^' + r.path.replace(/:[A-Za-z_][A-Za-z0-9_]*/g, '[^/]+') + '$';
+          return new RegExp(pattern).test(req.path);
+        }
+        return req.path === r.path;
+      }
      return r.prefix ? req.path.startsWith(r.path) : req.path === r.path;
    });
  }