From 11f97ee0915afb7f546b951b45092ef5399635ab Mon Sep 17 00:00:00 2001 From: Hampton Lintorn-Catlin Date: Tue, 1 Sep 2026 14:34:40 -0500 Subject: [PATCH] COPLAN-SQUARE-14: Direct agents to the API Authenticated non-browser GETs previously slipped through to web view rendering and could negotiate a nonexistent Markdown template. Return the existing API instructions response before web authentication instead. Amp-Thread-ID: https://ampcode.com/threads/T-01a043c0-9e59-7177-b513-9bc229ba3b59 Co-authored-by: Amp --- .../app/controllers/coplan/application_controller.rb | 9 ++++++--- spec/requests/browse_spec.rb | 12 ++++++++++++ 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/engine/app/controllers/coplan/application_controller.rb b/engine/app/controllers/coplan/application_controller.rb index 343413ee..50f73b37 100644 --- a/engine/app/controllers/coplan/application_controller.rb +++ b/engine/app/controllers/coplan/application_controller.rb @@ -45,11 +45,14 @@ def signed_in? end def authenticate_coplan_user! + if request.get? && agent_request? + render plain: agent_redirect_instructions, content_type: "text/markdown", status: :unauthorized + return + end + @current_coplan_user = CoPlan::Authentication.user_from_request(request) unless @current_coplan_user - if agent_request? - render plain: agent_redirect_instructions, content_type: "text/markdown", status: :unauthorized - elsif CoPlan.configuration.sign_in_path + if CoPlan.configuration.sign_in_path redirect_to CoPlan.configuration.sign_in_path, alert: "Please sign in." else head :unauthorized diff --git a/spec/requests/browse_spec.rb b/spec/requests/browse_spec.rb index 928d4f39..bf3b7063 100644 --- a/spec/requests/browse_spec.rb +++ b/spec/requests/browse_spec.rb @@ -63,6 +63,18 @@ def revise(plan, content, actor: author) expect(response).to have_http_status(:ok) expect(versioned.slug).to eq("pricing-v1-2") end + + it "directs an authenticated non-browser client to the API instructions" do + get "/hampton/liveorder/q3/cart-roadmap", headers: { + "Accept" => "text/markdown", + "User-Agent" => "curl/8.11.0" + } + + expect(response).to have_http_status(:unauthorized) + expect(response.media_type).to eq("text/markdown") + expect(response.body).to include("# CoPlan API") + expect(response.body).to include("/agent-instructions") + end end describe "the owner's own library" do