Fix /consulting/slideshow dead 403: INTERNAL_STATIC guard now redirects anon browser hits to /login (mirrors adminOnly)

f8daa54d8c8915f543631734df24f97080eafefe · 2026-08-06 11:58:20 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit f8daa54d8c8915f543631734df24f97080eafefe
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 6 11:58:20 2026 -0700

    Fix /consulting/slideshow dead 403: INTERNAL_STATIC guard now redirects anon browser hits to /login (mirrors adminOnly)
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 server.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 2dbe3667..e83668d1 100644
--- a/server.js
+++ b/server.js
@@ -2183,7 +2183,16 @@ require('./src/pr')(app, { adminOnly, sendPage, PUB });
 const INTERNAL_STATIC = /^\/(desk(\.html)?$|desk-assets\/|desk-admin|audience\.html|admin(\/|$|\.html)|versions(\/|$)|consulting(\/|$)|press(\/|$)|social(\.html)?$|summit-leads(\.html)?$|la-commercial(\.html)?$|pulse(\.html)?$|sector(\.html)?$|hub(\.html)?$|brief(\.html)?$)/i;
 app.use((req, res, next) => {
   if (req.role === 'admin') return next();
-  if (INTERNAL_STATIC.test(req.path)) return res.status(403).send('Admin only — this area requires an admin login.');
+  if (INTERNAL_STATIC.test(req.path)) {
+    // Mirror adminOnly: an anonymous browser deep-link to an internal shell (e.g.
+    // /consulting/slideshow, which never reaches the adminOnly route gate) is bounced to
+    // /login?next=… so admins can actually sign in and land on the page. APIs, logged-in
+    // user-tier, and non-GET requests still get the plain 403.
+    if (req.authVia === 'anon' && req.method === 'GET' && String(req.headers.accept || '').includes('text/html')) {
+      return res.redirect(302, '/login?next=' + encodeURIComponent(req.originalUrl));
+    }
+    return res.status(403).send('Admin only — this area requires an admin login.');
+  }
   next();
 });
 // Inject the Front End ⇄ Backend toggle into HTML pages that express.static would serve

← 0960554d consulting portal: remove dead theme-aware CSS (superseded b · back to Rentv · fix(auth): bridge server-admin session into /api/pr so deals 71ec8d49 →