Send signed-out link visitors to sign-in

cloudflare/auth-flow.test.ts

@@ -527,13 +527,15 @@ test("a service token manages the team library over MCP and confers nothing outs
   expect(wrong.status).toBe(401);
   expect(wrong.headers.get("www-authenticate")).toContain("resource_metadata=");
 
-  // A signed-in teammate finds the work in the team library and opens its private URL.
+  // A signed-out teammate opening the shared private URL signs in and returns to it.
   const context = await newBrowserContext();
   try {
     const page = await context.newPage();
-    await page.goto(`${origin}/?workspace=test`);
+    await page.goto(`${origin}/service-report`);
+    expect(new URL(page.url()).pathname).toBe("/sign-in");
     await login(page, "Bob");
-    await page.waitForURL(`${origin}/?workspace=test`);
+    await page.waitForURL(`${origin}/service-report`);
+    await page.frameLocator("iframe").getByText("Count: 0", { exact: true }).waitFor();
     const team = await (await context.request.get(`${origin}/api/gallery?workspace=test&library=team`)).json();
     expect(team.artifacts.find((item: any) => item.name === "service-report")).toMatchObject({ url: `${origin}/service-report`, access: "private" });
     const personal = await (await context.request.get(`${origin}/api/gallery?workspace=test`)).json();

cloudflare/better-auth.ts

@@ -123,11 +123,21 @@ export async function getArtifactAuth(env: BetterAuthEnvironment): Promise<Artif
   return auth;
 }
 
+/** A person opening a URL in a tab, such as a shared private link. Frames and
+ * fetches keep the JSON challenge; the gallery client redirects on that. */
+function documentNavigation(request: Request): boolean {
+  if (request.method !== "GET" && request.method !== "HEAD") return false;
+  const destination = request.headers.get("Sec-Fetch-Dest");
+  if (destination) return destination === "document";
+  // Browsers without Fetch Metadata still ask for HTML when navigating.
+  return request.headers.get("Accept")?.includes("text/html") ?? false;
+}
+
 export function browserSignIn(request: Request): Response {
   const current = new URL(request.url);
   const returnTo = current.pathname + current.search;
   const login = `/sign-in?returnTo=${encodeURIComponent(returnTo)}`;
-  if (request.method === "GET" && ["/", "/gallery"].includes(current.pathname)) {
+  if ((request.method === "GET" && ["/", "/gallery"].includes(current.pathname)) || documentNavigation(request)) {
     return new Response(null, { status: 302, headers: { Location: login, "Cache-Control": "no-store" } });
   }
   return Response.json({ error: "Sign in to Artifacts", loginUrl: login }, {