From cf8909740f305bbf10fa5fa4c8ff28e339d7041c Mon Sep 17 00:00:00 2001
From: Krystie <krystie@hermes.local>
Date: Wed, 8 Jul 2026 21:29:20 -0700
Subject: [PATCH] DC-044: fix legacy /api/auth/totp/check-session shim path
 (drop /auth)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shim added in the previous commit rewrote /api/auth/totp/check-session
to /api/v1/auth/totp/check-session, but the canonical route is mounted at
/totp/check-session (no /auth prefix). The 404 returned to the auto-login
JS path was Route GET /v1/auth/totp/check-session — Express's /api/v1
mount stripped the /api/v1 prefix, leaving /auth/totp/check-session, which
doesn't match /totp/check-session.

Drop both /api and /auth (9 chars) so the legacy path maps to the
canonical /api/v1/totp/check-session.

Verified after deploy:
  GET /api/auth/totp/check-session  -> {"authenticated":true}
  GET /api/v1/totp/check-session    -> {"authenticated":true}
---
 dashcaddy-api/src/app.js | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js
index cf03b17..b9c8595 100644
--- a/dashcaddy-api/src/app.js
+++ b/dashcaddy-api/src/app.js
@@ -196,15 +196,23 @@ async function createApp() {
   // three auth paths to the v1 mount so the gate is tolerant of that drift.
   // Must run before configureMiddleware() so CSRF/auth see the canonical path.
   // This is deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
-  // /api/auth/totp/check-session is added because the auto-login page JS in
-  // sso-gate.js (buildLoginPage) uses the legacy prefix; without this rewrite
-  // the JS gets a 404 and the page hangs at "Signing in to Plex..." forever
-  // (user-reported 2026-07-09).
+  //
+  // Path mapping (legacy -> canonical):
+  //   /api/auth/gate/<id>           -> /api/v1/auth/gate/<id>           (mounted at /auth/gate/:serviceId)
+  //   /api/auth/app-token/<id>      -> /api/v1/auth/app-token/<id>      (mounted at /auth/app-token/:serviceId)
+  //   /api/auth/totp/check-session  -> /api/v1/totp/check-session       (mounted at /totp/check-session — no /auth prefix)
+  //
+  // The totp case drops `/auth` because the canonical route is /totp/check-session
+  // (no /auth prefix) but the legacy JS still uses /api/auth/totp/check-session.
+  // Without this rewrite the JS gets a 404 and the page hangs at
+  // "Signing in to Plex..." forever (user-reported 2026-07-09).
   app.use((req, res, next) => {
-    if (req.url.startsWith('/api/auth/gate/')
-        || req.url.startsWith('/api/auth/app-token/')
-        || req.url.startsWith('/api/auth/totp/check-session')) {
+    if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/auth/app-token/')) {
       req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
+    } else if (req.url.startsWith('/api/auth/totp/check-session')) {
+      // Legacy: /api/auth/totp/check-session -> /api/v1/totp/check-session
+      // Drop both '/api' and '/auth' prefixes (9 chars total).
+      req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9
     }
     next();
   });