From a7b071464301ae53d37beaec56a28b718928edcd Mon Sep 17 00:00:00 2001
From: Krystie <krystie@hermes.local>
Date: Wed, 8 Jul 2026 21:24:28 -0700
Subject: [PATCH] DC-044: fix plex.sami auto-login JS 404 (add check-session to
 legacy shim)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Plex/Jellyfin/Emby/chat auto-login page JS (sso-gate.js
buildLoginPage) calls /api/auth/totp/check-session — the pre-1.5.0
legacy prefix. The back-compat shim in app.js only handled
/api/auth/gate/ and /api/auth/app-token/, so check-session 404'd and
the page hung at "Signing in to Plex..." forever (user reported
2026-07-09, confirmed: request returns "Route GET /v1/auth/totp/
check-session not found").

Add /api/auth/totp/check-session to the legacy path rewrite so the JS
gets the canonical /api/v1/totp/check-session endpoint.

Verified: plex.sami/dashcaddy-login now returns the auto-login page
and the JS check-session fetch resolves to {"authenticated":true} for
active TOTP sessions.
---
 dashcaddy-api/src/app.js | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js
index e1cca0f..cf03b17 100644
--- a/dashcaddy-api/src/app.js
+++ b/dashcaddy-api/src/app.js
@@ -192,12 +192,18 @@ async function createApp() {
   // auto-login pages) historically call these endpoints under the pre-1.5.0
   // prefix `/api/auth/...`. The canonical mount is `/api/v1`. Hand-maintained
   // Caddyfiles have repeatedly drifted back to the old prefix and 404'd the SSO
-  // gate (breaking Plex/Jellyfin/Emby/chat). Transparently rewrite ONLY these two
-  // auth paths to the v1 mount so the gate is tolerant of that drift. Must run
-  // before configureMiddleware() so CSRF/auth see the canonical path. This is
-  // deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
+  // gate (breaking Plex/Jellyfin/Emby/chat). Transparently rewrite ONLY these
+  // three auth paths to the v1 mount so the gate is tolerant of that drift.
+  // Must run before configureMiddleware() so CSRF/auth see the canonical path.
+  // This is deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
+  // /api/auth/totp/check-session is added because the auto-login page JS in
+  // sso-gate.js (buildLoginPage) uses the legacy prefix; without this rewrite
+  // the JS gets a 404 and the page hangs at "Signing in to Plex..." forever
+  // (user-reported 2026-07-09).
   app.use((req, res, next) => {
-    if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/auth/app-token/')) {
+    if (req.url.startsWith('/api/auth/gate/')
+        || req.url.startsWith('/api/auth/app-token/')
+        || req.url.startsWith('/api/auth/totp/check-session')) {
       req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
     }
     next();