@majordigital/create-acorn 1.6.3 → 1.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@majordigital/create-acorn",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "Interactive starter CLI for Acorn with Storyblok/Prismic/DatoCMS, TypeScript, and Tailwind.",
   "bin": {
     "create-acorn": "bin/create-acorn.mjs",

package/template/scripts/check-links.mjs

@@ -29,17 +29,29 @@ const concurrency = isLocalhost ? 2 : 5;
 // Support Netlify Basic Auth (password-protected preview deploys).
 // Set NETLIFY_AUTH=user:password in your environment before running.
 const netlifyAuth = process.env.NETLIFY_AUTH;
-const headers = netlifyAuth
-    ? { Authorization: `Basic ${Buffer.from(netlifyAuth).toString("base64")}` }
-    : {};
+
+// Extract hostname so we can match internal URLs with or without credentials.
+const { protocol, hostname } = new URL(baseUrl);
+const escapedHostname = hostname.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// Rewrite every internal link to include credentials so all requests authenticate.
+// Without this, links found in HTML use clean URLs and get 401.
+const urlRewriteExpressions = netlifyAuth
+    ? [{ pattern: new RegExp(`^${protocol}//${escapedHostname}`), replacement: `${protocol}//${netlifyAuth}@${hostname}` }]
+    : [];
+
+const crawlUrl = netlifyAuth
+    ? baseUrl.replace(/^(https?:\/\/)/, `$1${netlifyAuth}@`)
+    : baseUrl;
 
 const checker = new LinkChecker();
 
 checker.on("link", (result) => {
     if (result.state === "BROKEN") {
-        console.log(
-            `  BROKEN [${result.status}] ${result.url} (from ${result.parent})`,
-        );
+        // Strip credentials from URLs before printing
+        const url = result.url.replace(/\/\/[^@]+@/, "//");
+        const parent = result.parent?.replace(/\/\/[^@]+@/, "//");
+        console.log(`  BROKEN [${result.status}] ${url} (from ${parent})`);
     }
 });
 
@@ -49,14 +61,14 @@ console.log(`Concurrency: ${concurrency}`);
 console.log("This may take several minutes...\n");
 
 const result = await checker.check({
-    path: baseUrl,
+    path: crawlUrl,
     recurse: true,
     concurrency,
     timeout: 30000,
-    headers,
+    urlRewriteExpressions,
     linksToSkip: [
-        // Skip external links to avoid false positives from rate limiting
-        `^(?!(${baseUrl.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}))`,
+        // Skip URLs that don't contain our hostname (handles both clean and credential-embedded forms)
+        `^(?!https?://[^/@]*@?${escapedHostname})`,
         // Skip multi-filter URLs — the filter UI generates combinatorial links
         // (e.g. ?filter=a%2Cb%2Cc) that cause a crawl explosion. Not real links.
         ".*[?&]filter=.*%2C.*",
@@ -83,6 +95,8 @@ console.log(`OK: ${ok.length}`);
 console.log(`Broken: ${broken.length}`);
 console.log(`Skipped: ${skipped.length}`);
 
+const stripAuth = (u) => u?.replace(/\/\/[^@]+@/, "//") ?? u;
+
 let md = `## Broken Link Check\n\n`;
 md += `Crawled: ${baseUrl}\n\n`;
 md += `| Metric | Count |\n|--------|-------|\n`;
@@ -94,11 +108,11 @@ md += `| Skipped | ${skipped.length} |\n\n`;
 if (broken.length > 0) {
     const grouped = new Map();
     for (const link of broken) {
-        const key = link.url;
+        const key = stripAuth(link.url);
         if (!grouped.has(key)) {
-            grouped.set(key, { status: link.status, url: link.url, foundOn: new Set() });
+            grouped.set(key, { status: link.status, url: key, foundOn: new Set() });
         }
-        grouped.get(key).foundOn.add(link.parent);
+        grouped.get(key).foundOn.add(stripAuth(link.parent));
     }
 
     md += `### Broken Links (${grouped.size} unique)\n\n`;