P0: sign-in works while the workshop is closed: allow /_plat/* (redirect to /__forge/signin) and the owner paths through the resting guard #636

While the workshop is closed, clicking Sign in no longer returns {"error":"The arm is resting…","open":false}. The forge's signed-out link, /_plat/login?rd=%2F, now redirects to /__forge/signin?to=%2F.

• Redirects (Software/so101/src/relay.ts): /_plat/login?rd=… and this app's /signin?to=… answer 303 to /__forge/signin?to=<path>. /_plat/logout answers 303 to /__forge/signout. The return path is kept only when it is a path on this site; //host, /\host, full URLs and control characters fall back to /. Any other /_plat/* path is a 404, so nothing under it reaches the arm.
• One allow-list: RESTING_ALLOWED lists everything the closed workshop never refuses: /__forge/, /_plat/, /signin, /signout, /join, /admin, /story, /status, /link and /deploy-ok. Apart from the two prefixes these are exact paths, so a made-up /admin/elsewhere still gets the 503 and is never passed on to the arm. It replaces the old /__forge/-only check. /metrics, /version and every command still get the 503.
• {open:false} on every refusal: POST /turn was refused by an earlier check that left open:false out of its 503. That check in src/lobby.ts now includes it, and the relay passes it on.
• Test (src/resting.test.ts, which already holds the closed-workshop tests): a table-driven case runs with the workshop closed. It covers the redirects including the off-site return paths, POST /signout, the owner's POST /admin, and that /metrics, /version, POST /turn, POST /move and /admin/elsewhere stay 503 with {open:false}. The /_plat/login cases would fail without the fix.

The README's resting section and the relay's route comment now list the allow-list. The night-mode game routes from #632 are not in it yet; they get added when that lands.

The resting, relay, lobby, admin and accounts suites pass. tsc reports the same 37 errors as main, none in the changed files.

To try it on the preview: close the arm on /admin, sign out, then open /_plat/login?rd=%2Fadmin. It should land on the forge's sign-in and come back to /admin.

🤖 Generated with Claude Code

Closes #635

While the workshop is closed, clicking Sign in no longer returns {"error":"The arm is resting…","open":false}. The forge's signed-out link, /_plat/login?rd=%2F, now redirects to /__forge/signin?to=%2F.

• Redirects (Software/so101/src/relay.ts): /_plat/login?rd=… and this app's /signin?to=… answer 303 to /__forge/signin?to=<path>. /_plat/logout answers 303 to /__forge/signout. The return path is kept only when it is a path on this site; //host, /\host, full URLs and control characters fall back to /. Any other /_plat/* path is a 404, so nothing under it reaches the arm.
• One allow-list: RESTING_ALLOWED lists everything the closed workshop never refuses: /__forge/, /_plat/, /signin, /signout, /join, /admin, /story, /status, /link and /deploy-ok. Apart from the two prefixes these are exact paths, so a made-up /admin/elsewhere still gets the 503 and is never passed on to the arm. It replaces the old /__forge/-only check. /metrics, /version and every command still get the 503.
• {open:false} on every refusal: POST /turn was refused by an earlier check that left open:false out of its 503. That check in src/lobby.ts now includes it, and the relay passes it on.
• Test (src/resting.test.ts, which already holds the closed-workshop tests): a table-driven case runs with the workshop closed. It covers the redirects including the off-site return paths, POST /signout, the owner's POST /admin, and that /metrics, /version, POST /turn, POST /move and /admin/elsewhere stay 503 with {open:false}. The /_plat/login cases would fail without the fix.

The README's resting section and the relay's route comment now list the allow-list. The night-mode game routes from #632 are not in it yet; they get added when that lands.

The resting, relay, lobby, admin and accounts suites pass. tsc reports the same 37 errors as main, none in the changed files.

To try it on the preview: close the arm on /admin, sign out, then open /_plat/login?rd=%2Fadmin. It should land on the forge's sign-in and come back to /admin.

🤖 Generated with Claude Code

Clicking Sign in while the workshop is closed no longer returns the resting 503. The sign-in links all go to the forge's sign-in instead.

The first push failed one test: src/opening.test.ts still expected the old refusal without open: false. The test was out of date, not the code, so the second commit updates that one line. That suite, src/dose-pumps.test.ts and src/resting.test.ts pass now. I didn't rerun the whole suite; the forge's check will.

What changed in Software/so101/src/relay.ts:

• Redirects: /_plat/login?rd=… and this app's own /signin?to=… answer 303 to /__forge/signin?to=<path>. /_plat/logout answers 303 to /__forge/signout.
• Return path: it is kept only when it is a path on this site. //host, /\host, full URLs and control characters become /.
• *Other /_plat/ paths** are a 404, so nothing under that prefix reaches the arm.
• One allow-list: RESTING_ALLOWED names what the closed workshop never refuses: /__forge/, /_plat/, /signin, /signout, /join, /admin, /story, /status, /link and /deploy-ok. It replaces the old /__forge/-only check.
• Still refused: /metrics, /version and every arm command stay 503. Apart from the two prefixes the list holds exact paths, so a made-up /admin/elsewhere gets the 503 too and is never passed on to the arm.
• {open:false} on POST /turn: it was refused by an earlier check in Lobby.refusal (src/lobby.ts) whose 503 had no open:false. That refusal now includes it and the relay passes it on.

Test: a new table-driven case in src/resting.test.ts, run with the workshop closed. It checks:

• the redirects, including off-site return paths;
• POST /signout and the owner's POST /admin;
• that /metrics, /version, POST /turn, POST /move and /admin/elsewhere stay 503 {open:false}.

The /_plat/login cases fail without the fix.

The README's resting section lists the allow-list. The night-mode game routes from #632 aren't on it yet; they get added when that lands.

To try it on the preview: close the arm on /admin, sign out, then open /_plat/login?rd=%2Fadmin. It should land on the forge's sign-in and come back to /admin.

🤖 Generated with Claude Code