Match a deeplink's prefix and page name the way the router does

React Router compiles route paths with the `i` flag unless a route opts into
`caseSensitive`, so /Deeplink/apikeys reaches this loader. The prefix strip
required the literal lowercase /deeplink/, so the suffix came back empty and the
link landed on the environment root instead of the page. The page-name lookup
had the same problem one level down: /deeplink/APIKeys fell through even though
/env/{env}/APIKeys would have matched.

Fold the case of the prefix and of the first segment only, and resolve the name
to the map's own spelling. Everything after the first segment is left exactly as
written, since task and run ids are case-sensitive.

Author: claude

apps/webapp/app/utils/deeplinkPages.test.ts

@@ -1,7 +1,13 @@
+import { matchPath } from "@remix-run/router";
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
-import { deeplinkSuffix, ENV_PAGE_TARGETS, resolveDeeplinkPage } from "./deeplinkPages";
+import {
+  DEEPLINK_PATH_PREFIX,
+  deeplinkSuffix,
+  ENV_PAGE_TARGETS,
+  resolveDeeplinkPage,
+} from "./deeplinkPages";
 
 const ROUTES_DIR = join(__dirname, "../routes");
 
@@ -181,6 +187,35 @@ describe("resolveDeeplinkPage", () => {
     expect(resolveDeeplinkPage("metrics")).toBeUndefined();
   });
 
+  it("matches the page name whatever its case, and resolves it to the map's spelling", () => {
+    // `/env/{env}/APIKeys` matches its route, so the short link has to agree rather than falling
+    // through to the environment root.
+    expect(resolveDeeplinkPage("APIKeys")).toBe("apikeys");
+    expect(resolveDeeplinkPage("Waitpoints")).toBe("waitpoints/tokens");
+    expect(resolveDeeplinkPage("TASKS")).toBe("");
+    expect(resolveDeeplinkPage("Bulk-Actions")).toBe("bulk-actions");
+    // Case doesn't turn a non-page into a page.
+    expect(resolveDeeplinkPage("Nonsense")).toBeUndefined();
+    expect(resolveDeeplinkPage("Metrics")).toBeUndefined();
+  });
+
+  it("leaves the case of everything after the name alone", () => {
+    // Only the name is folded. Ids are case-sensitive, so lowercasing one would break the link far
+    // more thoroughly than the miss the folding fixes.
+    expect(resolveDeeplinkPage("runs/run_ABC123")).toBe("runs/run_ABC123");
+    expect(resolveDeeplinkPage("Runs/run_ABC123")).toBe("runs/run_ABC123");
+    expect(resolveDeeplinkPage("TASKS/standard/My-Task")).toBe("tasks/standard/My-Task");
+    // Grafted onto the prefix and already written out under it, both with the id untouched.
+    expect(resolveDeeplinkPage("Waitpoints/waitpoint_ABC")).toBe("waitpoints/tokens/waitpoint_ABC");
+    expect(resolveDeeplinkPage("Waitpoints/tokens/waitpoint_ABC")).toBe(
+      "waitpoints/tokens/waitpoint_ABC"
+    );
+    // An escaped slash inside a capitalised id survives as one segment, as it does in lower case.
+    expect(resolveDeeplinkPage("Tasks/standard/Group%2FMy-Task")).toBe(
+      "tasks/standard/Group%2FMy-Task"
+    );
+  });
+
   it("drops traversal segments, in plain and escaped spellings", () => {
     expect(resolveDeeplinkPage("runs/../../../etc/passwd")).toBe("runs/etc/passwd");
     expect(resolveDeeplinkPage("../runs")).toBe("runs");
@@ -216,6 +251,26 @@ describe("deeplinkSuffix", () => {
     );
   });
 
+  it("strips the prefix whatever its case, and only the prefix", () => {
+    expect(deeplinkSuffix("/Deeplink/apikeys")).toBe("apikeys");
+    expect(deeplinkSuffix("/DEEPLINK/runs/run_ABC123")).toBe("runs/run_ABC123");
+    // The remainder comes back as it was written, capitals and all.
+    expect(deeplinkSuffix("/DeepLink/tasks/standard/My-Task")).toBe("tasks/standard/My-Task");
+    expect(deeplinkSuffix("/Deeplink")).toBe("");
+    expect(deeplinkSuffix("/Deeplink/")).toBe("");
+  });
+
+  it("folds case because the route it is mounted on does", () => {
+    // The assertion the test above rests on: React Router compiles a route path with the `i` flag
+    // unless it opts into `caseSensitive`, so a capitalised prefix really does reach this loader
+    // instead of 404ing before it. If that ever changed, the folding would be dead weight.
+    const route = `${DEEPLINK_PATH_PREFIX}/*`;
+    expect(matchPath(route, "/deeplink/apikeys")?.params["*"]).toBe("apikeys");
+    expect(matchPath(route, "/Deeplink/apikeys")?.params["*"]).toBe("apikeys");
+    // And the splat keeps the case it was given, which is why only the first segment is folded.
+    expect(matchPath(route, "/DEEPLINK/APIKeys")?.params["*"]).toBe("APIKeys");
+  });
+
   it("treats a bare prefix, a trailing slash and anything outside it as no suffix", () => {
     expect(deeplinkSuffix("/deeplink")).toBe("");
     expect(deeplinkSuffix("/deeplink/")).toBe("");

apps/webapp/app/utils/deeplinkPages.ts

@@ -69,10 +69,15 @@ export const DEEPLINK_PATH_PREFIX = "/deeplink";
  * Returns "" for anything that is not under the prefix. That includes a pathname the URL parser has
  * already rewritten: it normalises `%2e%2e` to `..` and resolves it, so a traversal attempt can
  * leave the prefix entirely before this ever sees it.
+ *
+ * The prefix is matched case-insensitively because React Router's route matching is: it compiles
+ * every path with the `i` flag unless the route opts into `caseSensitive`, so `/Deeplink/apikeys`
+ * reaches this loader too. Only the prefix is folded — the remainder is returned as it was written,
+ * since the ids after the first segment are case-sensitive.
  */
 export function deeplinkSuffix(pathname: string): string {
   const withSlash = `${DEEPLINK_PATH_PREFIX}/`;
-  if (!pathname.startsWith(withSlash)) return "";
+  if (!pathname.toLowerCase().startsWith(withSlash)) return "";
 
   return pathname.slice(withSlash.length);
 }
@@ -105,18 +110,25 @@ function isUsableSegment(segment: string): boolean {
  *
  * `suffix` is expected already encoded (see `deeplinkSuffix`) and is passed through untouched — an
  * `encodeURIComponent` pass here would double-encode every id that contains an escape.
+ *
+ * Only the first segment is matched case-insensitively, to the same end as the prefix in
+ * `deeplinkSuffix`: `/env/{env}/APIKeys` would have matched its route, so `/deeplink/APIKeys` should
+ * reach it rather than falling through to the environment root. The name resolves to the map's own
+ * spelling, and every segment after it is left exactly as written — folding the case of a task or
+ * run id would break the link far more thoroughly than the miss this fixes.
  */
 export function resolveDeeplinkPage(suffix: string): string | undefined {
-  const segments = suffix.split("/").filter(isUsableSegment);
+  const [first = "", ...rest] = suffix.split("/").filter(isUsableSegment);
 
-  const target = ENV_PAGE_TARGETS.get(segments[0] ?? "");
+  const name = first.toLowerCase();
+  const target = ENV_PAGE_TARGETS.get(name);
   if (target === undefined) return undefined;
 
-  if (segments.length === 1) return target.landing;
+  if (rest.length === 0) return target.landing;
 
-  const written = segments.join("/");
+  const written = [name, ...rest].join("/");
   //already written out under the prefix, so grafting would duplicate it
   if (written === target.prefix || written.startsWith(`${target.prefix}/`)) return written;
 
-  return [target.prefix, ...segments.slice(1)].join("/");
+  return [target.prefix, ...rest].join("/");
 }