Repository navigation
feat(app-links): show a get-the-app page for sign-in links opened without the app - #497
Merged
Merged
Conversation
…inks opened without the app /game/<token> and /login/<code> open the DevFest.cz app when it is installed. Without it they hit the 404; they now land on a noindex page with App Store and Google Play links, served for every token by a Hosting rewrite.
lineupApi answers https://devfest-cz-app.web.app (and localhost dev servers) with CORS headers and Vary: Origin, so the edge cache keeps one copy per origin.
…pages # Conflicts: # scripts/a11y.mjs
…one set of store links page_location and page_referrer for /login/<code> and /game/<token> are cut to /login/ and /game/ before they reach GA4, and Performance Monitoring no longer boots on those paths. The get-the-app pages read the store links from APP_LINKS, now filled with the live App Store and Google Play listings, so /app shows the badges too. applyReadCors gets tests for the preflight, Vary: Origin and a refused origin.
…origin The PWA is one Hosting site under app.devfest.cz and devfest-cz-app.web.app; lineupApi now allows both, plus localhost for its dev server.
ryzizub
marked this pull request as ready for review
October 27, 2026 20:11
…arry only a token The printed codes hold a bare token, never a devfest.cz/game URL, so nothing lands on /game. Its page, rewrite, sitemap filter, a11y entry and analytics trimming go; /login keeps all of them.
ryzizub
changed the title
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The app's sign-in email link (
/login/<code>) now lands on a get-the-app page instead of the 404 when the app is not installed, and the code never reaches analytics.lineupApialso answers the app's PWA cross-origin, atapp.devfest.czanddevfest-cz-app.web.app.Why
With the app installed, iOS and Android open the sign-in link in the app. Without it (a computer, or a phone before install) the browser hit the 404. The PWA (one Hosting site at
app.devfest.czanddevfest-cz-app.web.app) could not read/api/lineupbecause the endpoint sent no CORS headers.Behavior
/login/<code>shows anoindexpage with App Store and Google Play links, kept out of the sitemap. One static page serves every code through a Hosting rewrite infirebase.json(/login/**), since a static build has no page per code.page_locationandpage_referrerare cut to/login/, and Performance Monitoring does not start on that path./appnow shows the App Store and Google Play badges instead of "Coming soon": the store links live once, insrc/lib/app-links.ts, filled with the live listings.lineupApisendsAccess-Control-Allow-Originonly tohttps://app.devfest.cz,https://devfest-cz-app.web.appandhttp://localhost:*, answers the preflight, and always sendsVary: Originso the CDN keeps one copy per origin. The other/api/*endpoints stay same-origin.Files
src/pages/login/index.astro: the page, store links fromsrc/lib/app-links.ts.src/lib/firebase.ts: sign-in link URLs redacted for GA4, Performance skipped on them.firebase.json: the rewrite.astro.config.mjs: the page out of the sitemap.functions/src/lib/cors.ts(+ tests for the origin match, preflight,Vary: Originand a refused origin),cached-endpoint.ts,lineup/lineup-api.ts: opt-in CORS per cached endpoint, on forlineupApi.scripts/a11y.mjs: the page in the axe sweep.README.md,.claude/rules/api.md,analytics.md,backend.md: docs.npm run verifypasses in full (check, complexity, function tests, a11y); nothing skipped.Type of Change
🤖 Generated with Claude Code