A data request or form post refused for its access token now says so with a WWW-Authenticate header, which the Worker adds since React Router drops the headers of what middleware throws, and the token form's warning says plainly that the website does not hold a token to its permissions. · efdfeee · flagon-io/g1t

12

import { repositoryOfPage, stillPublic } from "../app/lib/public-cache";

13

import { registryWorkspace, servicePath } from "../app/lib/registry-paths";

14

import { usercontentPath } from "../app/lib/usercontent";

15

+

import { TOKEN_CHALLENGE } from "../app/lib/website-token";

15

16

import { serveUsercontent } from "./usercontent";

16

17

18

const loadBuild = () => import("virtual:react-router/server-build");

103

104

// and keeps the reader's D1 bookmarks (app/lib/perf.server.ts).

104

105

const render = () => withRequestPerf(request, async () => finishResponse(request, await requestHandler(request)));

105

106

if (anonymousPage(request, pathname)) return servePublic(env, request, ctx, render);

106

−

return render();

107

+

const answer = await render();

108

+

// A token the site refused (app/lib/website-token.ts) is told so as the

109

+

// API tells it: React Router drops the headers of what middleware throws.

110

+

if (answer.status === 401 && request.headers.has("authorization")) answer.headers.set("www-authenticate", TOKEN_CHALLENGE);

111

+

return answer;

107

112

}

108

113

109

114

/**

51	51		*/
52	52		export const viewerMiddleware: MiddlewareFunction<Response> = async ({ request, context }, next) => {
53	53		const verdict = await tokenVerdict(request, (token) => identity.userForAccessToken(token));
54		−	if (verdict.kind === "refused") {
55		−	const headers: HeadersInit = verdict.status === 401 ? { "www-authenticate": TOKEN_CHALLENGE } : {};
56		−	throw data(verdict.body, { status: verdict.status, headers });
57		−	}
	54	+	// Thrown, so pages and client navigations show it as any error; the
	55	+	// Worker adds the 401's challenge header (workers/app.ts).
	56	+	if (verdict.kind === "refused") throw data(verdict.body, { status: verdict.status });
58	57		if (verdict.kind === "signed-out") {
59	58		// The page as anyone signed out sees it, saying the token was not taken.
60	59		const response = await next();