fix: resolve path to public assets in cloud

apps/server/src/middleware/__tests__/authenticate.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+
+import { isPublicAssetRequest } from '../authenticate.js';
+
+describe('isPublicAssetRequest()', () => {
+  it('allows root public assets without a prefix', () => {
+    expect(isPublicAssetRequest('/site.webmanifest', '')).toBe(true);
+    expect(isPublicAssetRequest('/manifest.json', '')).toBe(true);
+  });
+
+  it('allows prefixed public assets in cloud deployments', () => {
+    expect(isPublicAssetRequest('/stage-hash/site.webmanifest', '/stage-hash')).toBe(true);
+    expect(isPublicAssetRequest('/stage-hash/ontime-logo.png?cache=1', '/stage-hash')).toBe(true);
+  });
+
+  it('keeps non-public paths protected', () => {
+    expect(isPublicAssetRequest('/stage-hash/data', '/stage-hash')).toBe(false);
+    expect(isPublicAssetRequest('/backstage', '')).toBe(false);
+  });
+});

apps/server/src/middleware/authenticate.ts

@@ -21,6 +21,20 @@ const publicAssets = new Set([
   '/site.webmanifest',
 ]);
 
+export function isPublicAssetRequest(originalUrl: string, prefix: string): boolean {
+  const pathname = originalUrl.split('?')[0];
+
+  if (publicAssets.has(pathname)) {
+    return true;
+  }
+
+  if (prefix && pathname.startsWith(prefix)) {
+    return publicAssets.has(pathname.slice(prefix.length) || '/');
+  }
+
+  return false;
+}
+
 /**
  * Creates a login router with the provided prefix
  * @param {string} prefix - Prefix is used for the client hashes in Ontime Cloud
@@ -81,7 +95,7 @@ export function makeAuthenticateMiddleware(prefix: string) {
 
   function authenticateAndRedirect(req: Request, res: Response, next: NextFunction) {
     // Allow access to specific public assets without authentication
-    if (publicAssets.has(req.originalUrl)) {
+    if (isPublicAssetRequest(req.originalUrl, prefix)) {
       return next();
     }