From dd74ded28713775170deed2a37ae6241a5955662 Mon Sep 17 00:00:00 2001
From: martbost <martybostick@gmail.com>
Date: Wed, 16 Sep 2026 17:05:05 -0500
Subject: [PATCH] Profile read endpoint answers 200 signedIn:false for
 visitors, so a shared /my link logs no console error

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 public/my.html         | 2 +-
 public/profile-gate.js | 3 ++-
 server.js              | 4 +++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/public/my.html b/public/my.html
index 488fc84..94fac9e 100644
--- a/public/my.html
+++ b/public/my.html
@@ -31,5 +31,5 @@
 </section>
 </main>
 <footer class="wrap disclaimer">All figures are read live from the RM Circle smart contract on Polygon and are historical facts, not a promise of future results. Participation involves cryptocurrency and smart-contract risk. Never use funds you cannot afford to lose.<div class="footer-links"><a href="/">Home</a><a href="/contract">Contract Security</a><a href="/disclaimer">Disclaimers</a><a href="/tools">Promo Tools</a><a href="/privacy">Privacy</a><a href="/refunds">Refunds</a></div></footer>
-<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/profile-gate.js?v=20260916a"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/wallet-notice.js" defer></script>  <script src="/announce.js?v=20260916a"></script>
+<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/profile-gate.js?v=20260916b"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/wallet-notice.js" defer></script>  <script src="/announce.js?v=20260916a"></script>
 </body></html>
diff --git a/public/profile-gate.js b/public/profile-gate.js
index 4970c91..38ad5e0 100644
--- a/public/profile-gate.js
+++ b/public/profile-gate.js
@@ -167,7 +167,8 @@
   // who has not proved they own the position (the API 401s them).
   async function require_() {
     try { state = await api('/api/public/profile'); }
-    catch (e) { return null; }                      // not signed in: nothing to gate
+    catch (e) { return null; }
+    if (!state || state.signedIn === false) return null;   // a visitor on a shared link: never gate
     if (state.profile && state.profile.complete) return state.profile;
     if (back) return null;                          // already open
     shell();
diff --git a/server.js b/server.js
index ae2187e..828b947 100644
--- a/server.js
+++ b/server.js
@@ -1449,7 +1449,9 @@ async function handleApi(req,res,pathname){
   // Telegram Mini App bridge) can read or write one; /my/<id> is public and can not.
   if(req.method==='GET'&&pathname==='/api/public/profile'){
     const s=messages.authFromCookie(req);
-    if(!s)return json(res,401,{error:'Not signed in.'});
+    // 200 with signedIn:false, not 401: a shared /my/<id> link is opened by people
+    // who are not members, and a 401 there prints a console error that reads like a broken page.
+    if(!s)return json(res,200,{ok:true,signedIn:false});
     return json(res,200,Object.assign({ok:true,id:s.id,suggest:profiles.suggest(s.id)},profiles.status(s.id)));
   }
   if(req.method==='POST'&&pathname==='/api/public/profile/username'){