Make PWA icon + manifest public (no auth) so iOS Add-to-Home-Screen fetches them; app routes stay gated

f90170b551ee8679d570a10cd600f8226af69a8b · 2026-06-25 07:16:08 -0700 · steve@designerwallcoverings.com

Files touched

M data/build.json
M server.js

Diff

commit f90170b551ee8679d570a10cd600f8226af69a8b
Author: steve@designerwallcoverings.com <steve@designerwallcoverings.com>
Date:   Thu Jun 25 07:16:08 2026 -0700

    Make PWA icon + manifest public (no auth) so iOS Add-to-Home-Screen fetches them; app routes stay gated
---
 data/build.json | 5 +++--
 server.js       | 6 ++++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/data/build.json b/data/build.json
index d469465..9054d2e 100644
--- a/data/build.json
+++ b/data/build.json
@@ -1,5 +1,5 @@
 {
-  "next": 23,
+  "next": 24,
   "map": {
     "578af86f": 2,
     "bc95fdb0": 3,
@@ -21,6 +21,7 @@
     "598b1ee5": 19,
     "c3efeca8": 20,
     "859c4943": 21,
-    "a455891f": 22
+    "a455891f": 22,
+    "b6ea475b": 23
   }
 }
\ No newline at end of file
diff --git a/server.js b/server.js
index 9d3f790..e89534e 100644
--- a/server.js
+++ b/server.js
@@ -177,8 +177,10 @@ function send(res, code, body, headers = {}) {
 }
 
 const server = http.createServer((req, res) => {
-  // auth (allow /healthz open)
-  if (req.url !== '/healthz' && !checkAuth(req)) {
+  // public (no-auth) paths: health + the home-screen-install assets iOS fetches without creds
+  const PUBLIC = ['/healthz', '/icon-180.png', '/icon-512.png', '/apple-touch-icon.png', '/manifest.webmanifest'];
+  const _p = req.url.split('?')[0];
+  if (!PUBLIC.includes(_p) && !checkAuth(req)) {
     res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="DW Photo Capture"' });
     return res.end('Auth required');
   }

← 989aa83 Installable PWA: app icon (gold DW/camera) + web manifest + · back to Dw Photo Capture · Add /selfcheck self-check: server-side health report (catalo 8cdab9b →