LixRay: signed-out repository deep link shows “Repository not found” without a sign-in path

[felixhaeberle]

Summary

Opening a LixRay repository deep link while signed out renders only Repository not found and a Back to repositories link. The destination /home then explains that sign-in is required. The repository page itself gives no indication that authentication may resolve the problem.

This makes a valid private repository URL look broken and prevents clients or agents from distinguishing a missing repository from a missing session.

Reproduction

1. Sign out of LixRay or use a browser session without a LixRay login.
2. Open an existing private repository deep link in the documented format: https://lixray.com/@<namespace>/<repository>.
3. Wait for the app to load.

Observed

• The page contains only Repository not found and Back to repositories.
• Following the link to /home shows Sign in to see your repositories.
• No relevant browser console error is emitted.
• Reproduced on 25 August 2026 in both an isolated browser session and Chrome while signed out.

Expected

Keep repository enumeration protected, but offer a neutral sign-in action (or redirect to sign-in with a return URL) before concluding that the repository is unavailable. After authentication, the app can still show the generic not-found state when the user lacks access.

Security note

The signed-out page does not need to reveal whether the repository exists. A generic message such as “Sign in to open this repository” preserves non-enumeration while giving users a recovery path.

[samuelstroschein]

good issue! ty