mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 05:12:14 +00:00
Marc-André Bombeck
2acb11f80e
Adds the `/.well-known/` prefix to the proxy's `PUBLIC_PATHS` allowlist so RFC 8615 discovery endpoints reach a 200 response before the auth gate runs. Apple in particular reads `/.well-known/apple-app-site-association` without credentials to wire Web Credentials (passkey sharing) and Universal Links to the iOS bundle, and the previous 307 redirect to `/auth/login` broke that fetch on every host the app serves (`healthlog.bombeck.io` and `demo.healthlog.dev` both). The trailing-slash entry future-proofs the namespace for `/security.txt`, `/openid-configuration`, and the other well-known endpoints the IETF registry covers — adding a new file under `src/app/.well-known/` won't need a second proxy edit. A regression test pins the allowlist in place: unauthenticated requests for the AASA file (and a synthetic `/.well-known/security.txt` peer) must answer 200 with no location header, while a protected page like `/insights` still 307s to the auth gate.