From c7ced90aca96b96f2141366d82f1ee1c7f3a634b Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sun, 23 Aug 2026 18:33:54 -0700
Subject: [PATCH] Caddyfile: serve the homepage via handle blocks (fix the
 /admin/ 401)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Caddy SORTS top-level directives, so a 'rewrite' runs before 'basicauth'.
The rewrite changed /admin/ to /admin.html, and the path-based auth matchers
then saw /admin.html (which matched the family 'not path /admin/*' block, not
the operator '/admin/*' block) — so the operator password was checked against
the family hash and 401'd.

Serve each page from its own 'handle' block (which preserves order, so the
auth is checked on the original path before any file rewrite):
- handle /admin* : operator (frank) only, try_files /admin.html
- handle @data   : shared data + assets, family (dank) OR operator (frank), so
  the admin page's fetches of services.json/status.json reuse the operator
  credential
- handle         : everything else (the user page), family (dank)
---
 dankclaw/Caddyfile        | 44 ++++++++++++++++++++++++++++++---------
 tests/homepage_caddy.bats | 28 ++++++++++++++++++-------
 2 files changed, 55 insertions(+), 17 deletions(-)

diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index a14d157..0f36be7 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -46,17 +46,41 @@
 
 # --- Homepage (password protected) ---
 dankclaw.franksdank.cloud {
-	@admin path /admin/*
-	@user not path /admin/*
-	basicauth @user {
-		dank REPLACE_WITH_HASH
-	}
-	basicauth @admin {
-		frank REPLACE_WITH_ADMIN_HASH
-	}
-	rewrite @admin /admin.html
 	root * /srv/homepage
-	file_server
+
+	# Operator-only admin page (Q19). Auth is checked on the original path,
+	# before any rewrite, so the path matcher is reliable. Caddy sorts a
+	# top-level 'rewrite' before 'basicauth'; that would change the path and
+	# break the path-based auth matchers. 'handle' preserves order.
+	handle /admin* {
+		basicauth {
+			frank REPLACE_WITH_ADMIN_HASH
+		}
+		try_files /admin.html
+		file_server
+	}
+
+	# Shared data + assets: the family OR the operator, so both pages can load
+	# them (the browser reuses the page's credential for these fetches). A
+	# 'handle' inline matcher is a single token, so the multi-path match is a
+	# named matcher.
+	@data path /services.json /status.json /app.js /style.css /deployed.js
+	handle @data {
+		basicauth {
+			dank REPLACE_WITH_HASH
+			frank REPLACE_WITH_ADMIN_HASH
+		}
+		file_server
+	}
+
+	# Everything else (the user page): the family (Q18).
+	handle {
+		basicauth {
+			dank REPLACE_WITH_HASH
+		}
+		try_files /index.html
+		file_server
+	}
 }
 
 # --- Legacy name: the media host has no Caddy of its own anymore ---
diff --git a/tests/homepage_caddy.bats b/tests/homepage_caddy.bats
index 0a30ff5..1f871d7 100644
--- a/tests/homepage_caddy.bats
+++ b/tests/homepage_caddy.bats
@@ -16,8 +16,12 @@ setup() {
 }
 
 @test "the admin basicauth is scoped to /admin/ (Q19)" {
-    grep -qE "@admin[[:space:]]+path[[:space:]]+/admin/" "$CADDY"
-    grep -qE "basicauth[[:space:]]+@admin" "$CADDY"
+    # The admin page is a 'handle /admin*' block with the operator (frank)
+    # credential. Caddy sorts a top-level 'rewrite' before 'basicauth', which
+    # would change the path and break the path-based auth matcher; 'handle'
+    # preserves order, so the auth is checked on the original path.
+    grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
+    grep -qE "frank[[:space:]]+REPLACE_WITH_ADMIN_HASH" "$CADDY"
 }
 
 @test "the homepage serves /srv/homepage" {
@@ -25,9 +29,19 @@ setup() {
     grep -q "file_server" "$CADDY"
 }
 
-@test "the /admin/ path is rewritten to admin.html" {
-    # The matcher token follows the directive (rewrite @admin ...), per the
-    # Caddyfile matcher docs. A leading '@admin rewrite' is parsed as a
-    # one-liner matcher DEFINITION and re-defines @admin (invalid).
-    grep -qE "rewrite[[:space:]]+@admin[[:space:]]+/admin.html" "$CADDY"
+@test "the /admin/ page serves admin.html and / serves index.html" {
+    # Each page is served by its own 'handle' block via 'try_files' (which
+    # serves the named file without a top-level 'rewrite' that Caddy would
+    # sort before the basicauth).
+    grep -qE "try_files[[:space:]]+/admin.html" "$CADDY"
+    grep -qE "try_files[[:space:]]+/index.html" "$CADDY"
+}
+
+@test "the shared data + assets accept both the family and the operator" {
+    # The admin page (frank) and the user page (dank) both fetch the shared
+    # data (services.json, status.json) and assets. The browser reuses the
+    # page's credential for these, so the block must accept both users.
+    grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
+    grep -qE "handle[[:space:]]+@data" "$CADDY"
+    grep -qE "dank[[:space:]]+REPLACE_WITH_HASH" "$CADDY"
 }