From c7fe108ecffe320437beb4d68ab2dd25c1b6585d Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Tue, 26 May 2026 18:31:32 +0300 Subject: [PATCH] fix: AdminAuth prefix matched too greedily start_with?('/admin') also matched /admin-invoice-form.js, returning 401 for the public JS asset that the New Invoice form depends on. Without it, the "+ add line" button did nothing. Require either the bare /admin path or a /admin/-prefixed one so sibling assets in public/ that happen to share the prefix stay reachable. --- lib/admin_auth.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/admin_auth.rb b/lib/admin_auth.rb index 360fd7f..c7af28e 100644 --- a/lib/admin_auth.rb +++ b/lib/admin_auth.rb @@ -10,7 +10,8 @@ class AdminAuth end def call(env) - return @app.call(env) unless env['PATH_INFO'].to_s.start_with?('/admin') + path = env['PATH_INFO'].to_s + return @app.call(env) unless path == '/admin' || path.start_with?('/admin/') auth = Rack::Auth::Basic::Request.new(env) if @user && @pass && auth.provided? && auth.basic? && auth.credentials == [@user, @pass]