owner-auth: detect /api/* via originalUrl so middleware mounted at /api/calls returns 401 JSON

927b54f8a2ef378afb9729883175578f4789b778 · 2026-05-12 17:00:59 -0700 · SteveStudio2

Files touched

M lib/owner-auth.js

Diff

commit 927b54f8a2ef378afb9729883175578f4789b778
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Tue May 12 17:00:59 2026 -0700

    owner-auth: detect /api/* via originalUrl so middleware mounted at /api/calls returns 401 JSON
---
 lib/owner-auth.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/owner-auth.js b/lib/owner-auth.js
index 6f73610..fa8173d 100644
--- a/lib/owner-auth.js
+++ b/lib/owner-auth.js
@@ -48,7 +48,8 @@ function requireOwner(req, res, next) {
     res.setHeader('X-Robots-Tag', 'noindex, nofollow, noarchive');
     return next();
   }
-  if (req.path.startsWith('/api/')) {
+  // Use req.originalUrl (full path, NOT relative to mount point) to detect /api/*.
+  if (req.originalUrl.startsWith('/api/') || req.path.startsWith('/api/')) {
     return res.status(401).json({ ok: false, error: 'unauthorized', login_at: '/login' });
   }
   const back = encodeURIComponent(req.originalUrl);

← 73f6463 feat(auth): per-user accounts v2 — email+password signup/log · back to Butlr · migrate: re-link orphaned user_id refs to current legacy adm 4d008b0 →