Allow hosted static assets before auth

src/repixelizer/gui.py

@@ -1014,15 +1014,17 @@ def create_app():
             elif path.startswith("/api/jobs/"):
                 capability = "job_cancel_own" if request.method.upper() == "DELETE" else "job_read_own"
                 subject = resolve_job_subject(capability)
-            elif path == "/app" or path.startswith("/app/"):
+            elif path in {"/app", "/app/"}:
                 if access_controller.runtime.enabled and access_controller.runtime.required:
                     subject = access_controller.require_request_capability(request, "app_access")
                 else:
                     subject = access_controller.peek_request_subject(request)
+            elif path.startswith("/app/"):
+                subject = access_controller.peek_request_subject(request)
             else:
                 subject = access_controller.peek_request_subject(request)
         except AccessDenied as exc:
-            if path == "/app" or path.startswith("/app/"):
+            if path in {"/app", "/app/"}:
                 return RedirectResponse(url=access_controller.app_gate_redirect_url(), status_code=303)
             return JSONResponse({"detail": exc.detail}, status_code=exc.status_code)
 

tests/test_gui.py

@@ -469,6 +469,30 @@ def test_gui_heimdall_mode_redirects_to_landing_without_session(monkeypatch, tmp
     assert headers["location"] == "/"
 
 
+def test_gui_heimdall_mode_serves_static_assets_without_session(monkeypatch, tmp_path: Path) -> None:
+    from repixelizer.gui import create_app
+
+    monkeypatch.setenv("REPIXELIZER_HOSTED_DEMO", "1")
+    monkeypatch.setenv("REPIXELIZER_SPOOL_DIR", str(tmp_path / "spool"))
+    monkeypatch.setenv("GC_ACCESS_MODE", "heimdall")
+    monkeypatch.setenv("GC_ACCESS_HEIMDALL_BASE_URL", "https://heimdall.gamecult.org")
+    monkeypatch.setenv("GC_ACCESS_APP_PUBLIC_BASE_URL", "https://repixelizer.gamecult.org")
+    monkeypatch.setenv("GC_ACCESS_ALLOWED_PROVIDERS", "discord")
+
+    app = create_app()
+    css_status, css_headers, css_body = asyncio.run(_get_response(app, "/app/styles.css"))
+    logo_status, logo_headers, logo_body = asyncio.run(
+        _get_response(app, "/app/logos/repixelizer-logo-monogram.svg")
+    )
+
+    assert css_status == 200
+    assert "text/css" in css_headers["content-type"]
+    assert b"body" in css_body
+    assert logo_status == 200
+    assert "image/svg+xml" in logo_headers["content-type"]
+    assert b"<svg" in logo_body
+
+
 def test_gui_api_jobs_denies_unauthenticated_request_when_auth_required(monkeypatch, tmp_path: Path) -> None:
     from repixelizer.gui import create_app