PWA failed because HTTP basic auth block static assets

[heimoshuiyu]

Description

TLDR: Update the HTTP basic auth middleware to allow static resources through.

Reason: I run OPENCODE_SERVER_PASSWORD=iampassword opencode web to start the web service and configure an HTTPS certificate so I can access it via my phone browser outdoors (PWA requires HTTPS). But the browser wouldn’t recognize it as a PWA app.

After investigating, the issue is that OpenCode’s backend HTTP basic auth middleware at packages/opencode/src/server/server.ts blocks access to /site.webmanifest. After skipping auth for it, the browser correctly recognizes it as a PWA app.

Plugins

none

OpenCode version

dev

Steps to reproduce

1. OPENCODE_SERVER_PASSWORD=iampassword opencode web
2. Setup your HTTPS web proxy for it
3. Navigate to the HTTPS website. Check chromium F12 tool "Application"

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Web UI: Basic Auth incompatible with crossorigin attributes on assets #9206: Web UI: Basic Auth incompatible with crossorigin attributes on assets - Similar issue where HTTP basic auth blocks static assets from loading
• Basic Auth breaks the CORS support #10047: Basic Auth breaks the CORS support - Related issue about basic auth blocking asset access through CORS
• fix: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop) #8676: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set - Related issue about auth middleware blocking API calls

Feel free to ignore if none of these address your specific case.