breken 64ae230d23 fix(rules): decode percent-encoded PATH rule patterns before matching ...

isPathAllowed decodes the incoming request path (and Badger already sends
Go's decoded req.URL.Path), but compared it against the rule pattern as raw
text. isValidUrlGlobPattern rejects raw spaces and non-ASCII and only accepts
them percent-encoded, so a PATH rule such as `/my%20docs/*` or `/caf%C3%A9`
was stored as `my%20docs` / `caf%C3%A9` and compared against `my docs` /
`café`, and could therefore never match any request.

Run the pattern through the same decodeAndResolvePath normalisation as the
request path so both sides are compared in decoded form.

Claude-Session: https://claude.ai/code/session_0134ujLF81GyXsCByibLcYsz

2026-09-13 19:00:59 -07:00

..

exchangeSession.ts

Bind share link sessions to the token's own resource

2026-08-17 14:24:21 -04:00

index.ts

refactor auth to work cross domain and with http resources closes #100

2025-01-26 14:42:02 -05:00

logRequestAudit.ts

add virtual api key validation in verifySession

2026-08-12 10:38:26 -04:00

verifySession.test.ts

fix(rules): decode percent-encoded PATH rule patterns before matching

2026-09-13 19:00:59 -07:00

verifySession.ts

Bind share link sessions to the token's own resource

2026-08-17 14:24:21 -04:00