fix(web): send unsigned-in account visits to login

[Zach Dunn (zachdunn)]

In plain terms

Opening an account or admin URL while signed out used to dump you on a dead-end “You’re not signed in” page. Those visits now go to the login form, and after GitHub or a magic link you land back on the page you asked for.

What it does / what it is not

• Cookie-less /account/* and /admin/* requests 302 to /login?callbackURL=<original path>.
• Login already accepted same-origin callbackURL; it now also ignores /login itself so the bounce cannot loop.
• A session that expires after paint still replaces the page with login (client gate).
• Auth outages still show the existing “try again” UI instead of sending people to sign in.
• The loopback demo session is unchanged.
• Signed-in non-admins still see the admin access-denied panel.
• Device, invite, and OAuth consent keep their own sign-in UIs.

How to try it

In a private window, open https://uploads.sh/account/workspaces or any workspace screenshots URL. You should get the Sign in form, not the error callout. After signing in you should return to that same path.

Technical notes

Astro layouts cannot return Astro.redirect once HTML streaming has started, so the 302 lives in src/middleware.ts. callbackURL is a same-origin path only.

Test plan

• Helper: account/admin redirect, public pages skipped, local demo skipped, /login rejected as a return path
• Client gate: signed-out → location.replace with callbackURL; role mismatch still denied
• curl: unsigned-in /account/…?path= → 302 Location: /login?callbackURL=…
• Browser: /account/workspaces/acme/screenshots and /admin/users land on Sign in with the matching callback
• /docs still 200
• Signed-in round-trip: GitHub or magic link returns to the original path on production

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1dbf9f8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: aceb59a9-5d3c-434a-a957-81283190c67d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-web	1dbf9f8	Commit Preview URL Branch Preview URL	Aug 20 2026, 10:40 PM