When a web form link is requested without auth, should redirect to Central login

[lognaturel]

Identified at #837 (comment)

It can be handy to save a bookmark or link directly to a form that requires auth. Originally we had /-/<id> links that could be bookmarked and always redirected to login if no auth was provided. When we introduced /f/<id> links, those did not redirect to login. Recently we have made it so that /-/<id> no longer redirects to login.

The /-/<id> structure is most likely to be still linked to and saved as bookmarks so I think we should make sure that this structure redirects to login. Ideally /f/<id> would as well.

As of Central frontend getodk/central-frontend@9512dd8:

• ✅ Going to https://staging.getodk.cloud/projects/232/forms/pack_parcels/submissions/new without a valid session redirects to login
• ❌ Going to https://staging.getodk.cloud/f/foDO89bGf9mbQhErdwh4jSWvQL4ECr3 without a valid session does NOT redirect to login
• ❌ Going to https://staging.getodk.cloud/-/foDO89bGf9mbQhErdwh4jSWvQL4ECr3 without a valid session does NOT redirect to login

In Central v2026.1:

• ✅ Going to https://production.getodk.cloud/projects/3/forms/pack_parcels/submissions/new without a valid session redirects to login
• ❌ Going to https://production.getodk.cloud/f/LfMy1dprcpInBd2umqR3rhlGghe2vJE without a valid session does NOT redirect to login
• ✅ Going to https://production.getodk.cloud/-/LfMy1dprcpInBd2umqR3rhlGghe2vJE without a valid session does redirect to login

[garethbowen]

This is due to this change: #814

[lognaturel]

That makes sense, I didn't think about the fact that cookie auth would be treated the same way as token auth (st). I think the exception that's missing is that if there's no valid auth and no st query parameter then we should redirect to login.

[lognaturel]

@getodk/testers this is now on staging. I've verified that the links I posted now work 🎉 but it may give you some ideas of other things to check.

Thanks, @garethbowen!

[srujner]

@lognaturel @garethbowen

For now, I've just double-checked that the links work and read up on it a bit, and I'd like to do some more extensive testing, because I can see there are a lot of places and possibilities where something could go wrong.

I've added this topic to my list and will get to it once we're done with regression testing in Collect.