From abf21785bccbe050bf24d4fad3b70b242aff4c37 Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Mon, 31 Aug 2026 02:58:19 +0200
Subject: [PATCH] fix(hephaestus): make wallet.js /challenge and /verify paths
 relative
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Behind Caddy's /auth/* → auth-proxy rewrite, absolute fetch('/challenge')
resolved to origin root and hit Forgejo instead of the auth-proxy, so every
real user got "challenge request failed" when clicking sign-in.

Same root cause as the earlier fix for the CSS/JS asset paths — relative
paths work under both direct (:4000) and prefixed (/auth/) mounts.
---
 auth-proxy/public/wallet.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/auth-proxy/public/wallet.js b/auth-proxy/public/wallet.js
index d71b514..467e086 100644
--- a/auth-proxy/public/wallet.js
+++ b/auth-proxy/public/wallet.js
@@ -266,7 +266,7 @@ async function signInWithMnemonic(mnemonic, root) {
   if (btn) btn.disabled = true;
   try {
     const { privateKey, cashaddr } = await keypairFromMnemonic(mnemonic);
-    const chalRes = await fetch("/challenge", {
+    const chalRes = await fetch("challenge", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ cashaddr, state, redirect_uri: redirectUri }),
@@ -274,7 +274,7 @@ async function signInWithMnemonic(mnemonic, root) {
     if (!chalRes.ok) throw new Error("challenge request failed");
     const { nonce, message } = await chalRes.json();
     const signature = signMessage(privateKey, message);
-    const verRes = await fetch("/verify", {
+    const verRes = await fetch("verify", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ nonce, signature }),