@warpgogol/werkstatt-shared 0.8.2 → 0.8.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warpgogol/werkstatt-shared",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "private": false,
   "type": "module",
   "engines": {

package/src/share/image-provider.ts

@@ -219,6 +219,8 @@ export interface ImageVariantEntry {
    * stale derived variants (same contract as video.variants.generate RFC-0210).
    */
   sourceHash?: string;
+  /** RFC-0928: WebP quality used by image.variants.generate (minimum 90). */
+  quality?: number;
 }
 
 /** Top-level manifest written by `image.variants.generate` and read by createBuildPortableProvider. */

package/src/share/middleware/access-protection.ts

@@ -45,6 +45,16 @@ function isDevOrAltHost(host: string): boolean {
   return host.startsWith("dev.") || host.startsWith("alt.");
 }
 
+/**
+ * Paths exempt from access protection on dev/alt subdomains.
+ * Browsers fetch these without sending Basic Auth credentials, causing 401 console errors.
+ */
+const PUBLIC_STATIC_EXEMPTIONS = ["/manifest.webmanifest"];
+
+function isExemptPath(pathname: string): boolean {
+  return PUBLIC_STATIC_EXEMPTIONS.includes(pathname);
+}
+
 /**
  * RFC-0899: Check access protection for a request. Called from the Worker entry point
  * (worker.ts) before passing to the Astro handler. This is necessary because Astro
@@ -66,6 +76,9 @@ export function checkAccessProtection(
   const host = request.headers.get("host") ?? "";
   if (!isDevOrAltHost(host)) return null;
 
+  const url = new URL(request.url);
+  if (isExemptPath(url.pathname)) return null;
+
   const pin = (env.ACCESS_PIN as string | undefined) ?? undefined;
 
   // No PIN set — allow access (caller should add X-Robots-Tag)
@@ -144,6 +157,13 @@ export const accessProtectionMiddleware = defineMiddleware(async (context: any,
     return next();
   }
 
+  const url = new URL(context.request.url);
+  if (isExemptPath(url.pathname)) {
+    const response = await next();
+    response.headers.set("X-Robots-Tag", NOINDEX_HEADER);
+    return response;
+  }
+
   const pin = await resolveAccessPin();
 
   // No PIN set — allow access but still set noindex headers

package/src/share/middleware/tests/access-protection.test.ts

@@ -25,7 +25,7 @@ describe("RFC-0899: access protection middleware", () => {
     ) => Promise<Response>;
   }
 
-  function makeContext(host: string, authHeader?: string) {
+  function makeContext(host: string, authHeader?: string, pathname = "/") {
     const headers = new Map<string, string>();
     headers.set("host", host);
     if (authHeader) headers.set("authorization", authHeader);
@@ -34,6 +34,7 @@ describe("RFC-0899: access protection middleware", () => {
         headers: {
           get: (name: string) => headers.get(name.toLowerCase()) ?? null,
         },
+        url: `https://${host}${pathname}`,
       },
     };
   }
@@ -42,10 +43,11 @@ describe("RFC-0899: access protection middleware", () => {
     handler: (context: unknown, next: () => Promise<Response>) => Promise<Response>,
     host: string,
     authHeader?: string,
+    pathname = "/",
   ): Promise<Response & { _nextCalled: boolean }> {
     let nextCalled = false;
     const nextResponse = new Response("page content", { status: 200 });
-    const result = await handler(makeContext(host, authHeader), async () => {
+    const result = await handler(makeContext(host, authHeader, pathname), async () => {
       nextCalled = true;
       return nextResponse;
     });
@@ -120,4 +122,21 @@ describe("RFC-0899: access protection middleware", () => {
     const res = await runMiddleware(handler, "example.com");
     expect(res.headers.get("X-Robots-Tag")).toBe(null);
   });
+
+  it("exempts /manifest.webmanifest from auth on dev.* when PIN is set", async () => {
+    mockEnv.ACCESS_PIN = "1234";
+    const handler = await loadMiddleware();
+    const res = await runMiddleware(handler, "dev.example.com", undefined, "/manifest.webmanifest");
+    expect(res._nextCalled).toBe(true);
+    expect(res.status).toBe(200);
+    expect(res.headers.get("X-Robots-Tag")).toBe("noindex, nofollow, noai, noimageai");
+  });
+
+  it("exempts /manifest.webmanifest from auth on alt.* when PIN is set", async () => {
+    mockEnv.ACCESS_PIN = "1234";
+    const handler = await loadMiddleware();
+    const res = await runMiddleware(handler, "alt.example.com", undefined, "/manifest.webmanifest");
+    expect(res._nextCalled).toBe(true);
+    expect(res.status).toBe(200);
+  });
 });