From ca450bec5456468531813cb689852b319b3f2f75 Mon Sep 17 00:00:00 2001
From: benjdlambert <ben@blam.sh>
Date: Tue, 26 May 2026 10:33:37 +0200
Subject: [PATCH] Add config to disable experimental public entry point

Signed-off-by: benjdlambert <ben@blam.sh>
---
 .changeset/disable-experimental-public-entrypoint.md | 5 +++++
 plugins/app-backend/config.d.ts                      | 9 +++++++++
 plugins/app-backend/src/service/router.ts            | 7 ++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/disable-experimental-public-entrypoint.md

diff --git a/.changeset/disable-experimental-public-entrypoint.md b/.changeset/disable-experimental-public-entrypoint.md
new file mode 100644
index 0000000000..928d42ca33
--- /dev/null
+++ b/.changeset/disable-experimental-public-entrypoint.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app-backend': patch
+---
+
+Added a new `app.disableExperimentalPublicEntryPoint` config option that allows you to opt out of the automatic public sign-in entry point. When set to `true`, the app backend will skip serving the public entry point to unauthenticated users, even if the app was bundled with an `index-public-experimental` entry point.
diff --git a/plugins/app-backend/config.d.ts b/plugins/app-backend/config.d.ts
index dc11bc4e0a..f28b6e996d 100644
--- a/plugins/app-backend/config.d.ts
+++ b/plugins/app-backend/config.d.ts
@@ -42,5 +42,14 @@ export interface Config {
      * If you disable this, it is recommended to set a `staticFallbackHandler` instead.
      */
     disableStaticFallbackCache?: boolean;
+
+    /**
+     * Disables the experimental public entry point used for unauthenticated
+     * sign-in pages. When the app is bundled with an
+     * `index-public-experimental` entry point, the app backend will
+     * automatically serve it to unauthenticated users. Set this to `true` to
+     * skip that behavior and always serve the main entry point instead.
+     */
+    disableExperimentalPublicEntryPoint?: boolean;
   };
 }
diff --git a/plugins/app-backend/src/service/router.ts b/plugins/app-backend/src/service/router.ts
index 4841f2546a..c5b2ec2bfa 100644
--- a/plugins/app-backend/src/service/router.ts
+++ b/plugins/app-backend/src/service/router.ts
@@ -153,7 +153,12 @@ export async function createRouter(
 
   const publicDistDir = resolvePath(appDistDir, 'public');
 
-  const enablePublicEntryPoint = await fs.pathExists(publicDistDir);
+  const disableExperimentalPublicEntryPoint = config.getOptionalBoolean(
+    'app.disableExperimentalPublicEntryPoint',
+  );
+  const enablePublicEntryPoint =
+    !disableExperimentalPublicEntryPoint &&
+    (await fs.pathExists(publicDistDir));
 
   if (enablePublicEntryPoint) {
     logger.info(