From 099efc2c2b8055fb0aa93f04ed263d3a1317cdd9 Mon Sep 17 00:00:00 2001
From: Nico Ritschel <ritschel@gmail.com>
Date: Wed, 14 Oct 2026 14:02:12 -0700
Subject: [PATCH] Send signed-out link visitors to sign-in

Private links and other non-gallery paths answered a signed-out browser
with a JSON 401, leaving no way to sign in. Top-level document
navigations now redirect to /sign-in with returnTo, so the visitor lands
back on the link after signing in. Fetches, frames and MCP keep the JSON
challenge.
---
 cloudflare/auth-flow.test.ts |  8 +++++---
 cloudflare/better-auth.ts    | 12 +++++++++++-
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/cloudflare/auth-flow.test.ts b/cloudflare/auth-flow.test.ts
index 8354877..0dc4f24 100644
--- a/cloudflare/auth-flow.test.ts
+++ b/cloudflare/auth-flow.test.ts
@@ -527,13 +527,15 @@ test("a service token manages the team library over MCP and confers nothing outs
   expect(wrong.status).toBe(401);
   expect(wrong.headers.get("www-authenticate")).toContain("resource_metadata=");
 
-  // A signed-in teammate finds the work in the team library and opens its private URL.
+  // A signed-out teammate opening the shared private URL signs in and returns to it.
   const context = await newBrowserContext();
   try {
     const page = await context.newPage();
-    await page.goto(`${origin}/?workspace=test`);
+    await page.goto(`${origin}/service-report`);
+    expect(new URL(page.url()).pathname).toBe("/sign-in");
     await login(page, "Bob");
-    await page.waitForURL(`${origin}/?workspace=test`);
+    await page.waitForURL(`${origin}/service-report`);
+    await page.frameLocator("iframe").getByText("Count: 0", { exact: true }).waitFor();
     const team = await (await context.request.get(`${origin}/api/gallery?workspace=test&library=team`)).json();
     expect(team.artifacts.find((item: any) => item.name === "service-report")).toMatchObject({ url: `${origin}/service-report`, access: "private" });
     const personal = await (await context.request.get(`${origin}/api/gallery?workspace=test`)).json();
diff --git a/cloudflare/better-auth.ts b/cloudflare/better-auth.ts
index 11181d8..009aee9 100644
--- a/cloudflare/better-auth.ts
+++ b/cloudflare/better-auth.ts
@@ -123,11 +123,21 @@ export async function getArtifactAuth(env: BetterAuthEnvironment): Promise<Artif
   return auth;
 }
 
+/** A person opening a URL in a tab, such as a shared private link. Frames and
+ * fetches keep the JSON challenge; the gallery client redirects on that. */
+function documentNavigation(request: Request): boolean {
+  if (request.method !== "GET" && request.method !== "HEAD") return false;
+  const destination = request.headers.get("Sec-Fetch-Dest");
+  if (destination) return destination === "document";
+  // Browsers without Fetch Metadata still ask for HTML when navigating.
+  return request.headers.get("Accept")?.includes("text/html") ?? false;
+}
+
 export function browserSignIn(request: Request): Response {
   const current = new URL(request.url);
   const returnTo = current.pathname + current.search;
   const login = `/sign-in?returnTo=${encodeURIComponent(returnTo)}`;
-  if (request.method === "GET" && ["/", "/gallery"].includes(current.pathname)) {
+  if ((request.method === "GET" && ["/", "/gallery"].includes(current.pathname)) || documentNavigation(request)) {
     return new Response(null, { status: 302, headers: { Location: login, "Cache-Control": "no-store" } });
   }
   return Response.json({ error: "Sign in to Artifacts", loginUrl: login }, {