v4: a remote user's pages get their link previews and redirects — the Open Graph middleware passed on every path with a dot in it, taking it for a file's, and the handle of a user from a real host has dots (/@bob@music.example), so their profile, dumps and playlists had no tags, and a former name or another case of theirs no 301. Only the dev instances' localhost:8000 escaped it. parsePagePath already passes on any path that doesn't start with @, which no file's does, so the dot check is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/middleware/og.ts

@@ -114,9 +114,9 @@ export async function ogMiddleware(
 ): Promise<unknown> {
   const { pathname } = ctx.request.url;
 
-  if (pathname.startsWith("/api/") || pathname.includes(".")) {
+  // A file's path never starts with `@`, so parsePagePath passes it on, while
-    return await next();
+  // a remote user's has dots in it: `/@bob@music.example`.
-  }
+  if (pathname.startsWith("/api/")) return await next();
 
   const page = parsePagePath(pathname);
   if (!page || (page.kind === "dump" && page.edit)) return await next();

api/test/middleware/og.test.ts

@@ -151,6 +151,16 @@ test("ogMiddleware: a former slug, a former name or another case gets a 301", as
     assertEquals(res.status, 301, from);
     assertEquals(res.headers.get("location"), `${BASE_URL}${to}`, from);
   }
+  // A remote user's path has dots in it, as a file's does.
+  const remote = await createUser({ username: "bob@music.example" });
+  const remoteDump = insertDump({ userId: remote.id, title: "Far" });
+  assertStringIncludes(
+    (await handle(ogApp(), remoteDump.path)).text,
+    `<meta property="og:title" content="Far" />`,
+  );
+  const { res } = await handle(ogApp(), "/@BOB@music.example/dumps/far");
+  assertEquals(res.status, 301);
+  assertEquals(res.headers.get("location"), `${BASE_URL}${remoteDump.path}`);
   // A private dump's former slug tells nothing.
   const secret = insertDump({ userId: user.id, title: "S", isPrivate: true });
   db.prepare(