Before the extraction this worked by pasting https://officer.example.com into a
Bitwarden client and logging in normally. The extraction moved the door to
/api/vault/bw, which needs five URLs configured by hand — technically the same
thing, practically nobody's setup.
Declares what it actually needs, now that the platform can express it:
unauthenticatedRootPaths /identity, /notifications, /icons, /events — the
four a Bitwarden client derives from a bare server
URL. None is a name Officer serves, so the path
alone decides and no sniffing is involved.
protocolHeaders bitwarden-client-name, bitwarden-client-version,
device-type — for /api/*, the one namespace both
servers claim, where the path cannot separate
Vaultwarden's /api/sync from Officer's /api/chat.
`publicRouter` is exported for the platform to mount above the gate. One router
serves all three doors: it strips /api/vault/bw when reached that way, and
otherwise the path is already Vaultwarden's own.
/bw stays. It costs nothing and remains the explicit address for a client that
would rather be told than infer.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pastilhasandClaude Opus 5
4006be0e3b