fix(indiekit): return error instead of redirect for API GET requests with invalid bearer token

packages/endpoint-micropub/test/integration/403-query-invalid-me-in-api-get.js

@@ -0,0 +1,29 @@
+import { strict as assert } from "node:assert";
+import { after, describe, it } from "node:test";
+
+import { mockAgent } from "@indiekit-test/mock-agent";
+import { testServer } from "@indiekit-test/server";
+import supertest from "supertest";
+
+await mockAgent("indiekit");
+
+const server = await testServer({
+  application: {
+    tokenEndpoint: "https://token-endpoint.example",
+    introspectionEndpoint: "https://token-endpoint.example/introspect",
+  },
+});
+
+describe("endpoint-micropub GET /micropub", () => {
+  it("Returns 403 error when me does not match publication in api GET request", async () => {
+    const result = await supertest(server)
+      .get("/micropub")
+      .auth("another", { type: "bearer" })
+      .set("accept", "application/json")
+      .query({ q: "config" });
+
+    assert.equal(result.status, 403);
+  });
+
+  after(() => server.close());
+});

packages/indiekit/lib/indieauth.js

@@ -242,7 +242,11 @@ export const IndieAuth = class {
 
         next();
       } catch (error) {
-        if (request.method === "GET") {
+        const isApiRequest =
+          request.headers.authorization?.toLowerCase().startsWith("bearer ") ||
+          request.headers.accept?.includes("application/json");
+
+        if (!isApiRequest && request.method === "GET") {
           return response.redirect(
             `/session/login?redirect=${request.originalUrl}`,
           );