From f92d2bb642383a4734ae4ffd77aaafa230804860 Mon Sep 17 00:00:00 2001 From: gitomarcourt Date: Fri, 3 Jul 2026 18:30:14 +0200 Subject: [PATCH] fix: allow / and /static/ paths without token so login page can load --- dashboard/app.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dashboard/app.py b/dashboard/app.py index 7872a0a..4166fa9 100644 --- a/dashboard/app.py +++ b/dashboard/app.py @@ -16,14 +16,17 @@ DB_PATH = os.environ.get("DB_PATH", "/data/messages.db") Path(DB_PATH).parent.mkdir(parents=True, exist_ok=True) TOKEN = os.environ.get("DASHBOARD_TOKEN", "").strip() -PUBLIC_ROUTES = {"/webhook", "/healthz"} +# Public: HTML shell + static assets (login page needs to load) + webhook + health +PUBLIC_ROUTES = {"/", "/webhook", "/healthz"} +PUBLIC_PREFIXES = ("/static/",) app = Flask(__name__, static_folder="static", static_url_path="/static") @app.before_request def _check_token(): - if not TOKEN or request.path in PUBLIC_ROUTES: + p = request.path + if not TOKEN or p in PUBLIC_ROUTES or p.startswith(PUBLIC_PREFIXES): return None supplied = ( request.headers.get("Authorization", "").removeprefix("Bearer ").strip()