fix: authenticate protected PWA manifest requests

[Tokra110]

Why this change is needed

Jotty can be deployed behind an authentication reverse proxy that protects every application path, including the web app manifest.

In this setup, a browser may create a normal home-screen shortcut instead of offering to install Jotty as a PWA.

The browser requests Jotty's app manifest without the existing login credentials. The authentication proxy redirects that request to its login page, so the browser cannot recognize Jotty as an installable app.

What this changes

This change tells the browser to include the existing login credentials when it requests /api/manifest.

For normal Jotty installations, the manifest URL and behavior stay the same. For installations protected by an authentication reverse proxy, the browser can now read the manifest and offer the proper PWA installation instead of only creating a shortcut.

Type of change (pick one or more if needed)

• Bug fix
• New feature
• Refactoring
• Documentation
• Other

Please check the following:

• Branching: I branched out of develop and I am targeting develop for this PR. (Code directed to main will be closed).
• AI Code: If I used AI, I have cleaned up the code, removed bloat, and verified logic.
• Translations: I have used translation keys. I have not included any hardcoded strings (see howto/TRANSLATIONS.md).
• Components: I used pre-existing components from app/_components/GlobalComponents/ or FeatureComponents/ instead of creating duplicates.
• Styling: I have kept styling consistent and avoided inline styles.
• Self-Review: I have performed a self-review of my code.

Validation

• yarn lint
• yarn tsc --noEmit
• yarn test:run tests/security --reporter=verbose (39 tests)
• yarn test:run tests/api --reporter=verbose (141 tests)
• yarn test:run tests/server-actions --reporter=verbose (459 tests)
• yarn build
• Tested with a production container and confirmed that the manifest is valid and the generated link includes crossorigin="use-credentials".

Summary by CodeRabbit

• Bug Fixes
  • Improved web app manifest loading by adding a document-level manifest link with credential support.

[coderabbitai]

📝 Walkthrough

Walkthrough

The layout removes the manifest entry from generated metadata. It adds a document-level manifest link that targets /api/manifest and uses credentialed cross-origin requests.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enabling authentication for protected PWA manifest requests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[fccview]

whops 😆
Mind removing this and I'll approve? ❤️

[Tokra110]

Hey,

removed it :)