From a4fab3dcc9249d3c309b1e380995d6a45a29959c Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Mon, 17 Aug 2026 21:54:26 +0000
Subject: [PATCH] Ping our own API for auth check, not auth backend (forward
 auth).

---
 AGENTS.md                | 16 +++++++++-------
 frontend/src/pagerite.js | 12 +++++++-----
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 1717e4a..eb03692 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -97,13 +97,15 @@ not for the public pages. See `docs/design-principles.md` for the design.
     - `pagerite.js` — public page entry; runs fetch-navigation, scroll-reveal,
       brand shrink-to-fit (the themed size is the maximum; JS reduces the
       font-size so a long brand or narrow viewport still fits one line),
-      code copy buttons, and the auth check: it fetches
-      `/auth/api/validate?perm=pagerite:admin` and only then injects the 🖊️
-      edit pens (asset URLs from the `pagerite:editor-src`/`-css` meta tags);
-      a 401 adds a "log in" link to `/auth/` in the banner corner, a 403
-      nothing, and any other result (no auth server, e.g. dev) leaves
-      editing open. Pages themselves render identically for everyone; the
-      real gate is the auth proxy in front of all of `/_api`. The backend links the shared CSS as two separate
+      code copy buttons, and the auth check: it probes `GET /_api/settings`
+      and only then injects the 🖊️ edit pens (asset URLs from the
+      `pagerite:editor-src`/`-css` meta tags). The same reverse proxy that
+      gates `/_api` returns 401 for anonymous users, 403 for users without
+      the admin permission, and 200 for admins; a 401 adds a "log in" link
+      to `/auth/` in the banner corner, a 403 nothing, and any other
+      result (no auth proxy, e.g. dev) leaves editing open. Pages themselves
+      render identically for everyone; the real gate is the auth proxy in
+      front of all of `/_api`. The backend links the shared CSS as two separate
       stylesheets (base and theme) so they can be swapped or augmented.
     - `assets/` — shared styles and data files built by Vite and served hashed
       under `/_assets/`: `pagerite.css` (base layout + conservative variables),
diff --git a/frontend/src/pagerite.js b/frontend/src/pagerite.js
index fd65880..736e11d 100644
--- a/frontend/src/pagerite.js
+++ b/frontend/src/pagerite.js
@@ -28,11 +28,13 @@
 
   // --- Auth-gated edit pens ---------------------------------------------
   // Pages render identically for everyone; the 🖊️ pens are injected by JS
-  // only after the auth server validates the session (perm pagerite:admin).
+  // only after we know the user has pagerite:admin access. We probe our own
+  // /_api/settings endpoint: the same reverse proxy that gates /_api returns
+  // 401/403 here, and a 200 means the permission is present.
   // 401 = anonymous: show a small login link in the banner corner instead.
   // 403 = logged in without the permission: no pens. Any other outcome
-  // (404, network error — i.e. no auth server deployed, as in dev) leaves
-  // editing open as before: the real gate is the proxy in front of /_api.
+  // (network error — i.e. no auth proxy deployed, as in dev) leaves editing
+  // open as before: the real gate is the proxy in front of /_api.
   let authorized = false;
   let editorMeta = null;
 
@@ -78,9 +80,9 @@
     };
     let status = 0;
     try {
-      status = (await fetch("/auth/api/validate?perm=pagerite:admin")).status;
+      status = (await fetch("/_api/settings")).status;
     } catch {
-      // Auth server unreachable: treat as not deployed.
+      // Auth proxy unreachable: treat as not deployed.
     }
     if (status === 401) addLoginLink();
     else if (status !== 403) {