From a5000542e0983f6ae4ad476d3b4d7791ae5344d2 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Wed, 29 Apr 2026 12:46:42 +0100 Subject: [PATCH] Allow hosted static assets before auth --- src/repixelizer/gui.py | 6 ++++-- tests/test_gui.py | 24 ++++++++++++++++++++++++ 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/src/repixelizer/gui.py b/src/repixelizer/gui.py index 2cdeeb7..b2a9980 100644 --- a/src/repixelizer/gui.py +++ b/src/repixelizer/gui.py @@ -1014,15 +1014,17 @@ def create_app(): elif path.startswith("/api/jobs/"): capability = "job_cancel_own" if request.method.upper() == "DELETE" else "job_read_own" subject = resolve_job_subject(capability) - elif path == "/app" or path.startswith("/app/"): + elif path in {"/app", "/app/"}: if access_controller.runtime.enabled and access_controller.runtime.required: subject = access_controller.require_request_capability(request, "app_access") else: subject = access_controller.peek_request_subject(request) + elif path.startswith("/app/"): + subject = access_controller.peek_request_subject(request) else: subject = access_controller.peek_request_subject(request) except AccessDenied as exc: - if path == "/app" or path.startswith("/app/"): + if path in {"/app", "/app/"}: return RedirectResponse(url=access_controller.app_gate_redirect_url(), status_code=303) return JSONResponse({"detail": exc.detail}, status_code=exc.status_code) diff --git a/tests/test_gui.py b/tests/test_gui.py index 6fc40ee..79781fa 100644 --- a/tests/test_gui.py +++ b/tests/test_gui.py @@ -469,6 +469,30 @@ def test_gui_heimdall_mode_redirects_to_landing_without_session(monkeypatch, tmp assert headers["location"] == "/" +def test_gui_heimdall_mode_serves_static_assets_without_session(monkeypatch, tmp_path: Path) -> None: + from repixelizer.gui import create_app + + monkeypatch.setenv("REPIXELIZER_HOSTED_DEMO", "1") + monkeypatch.setenv("REPIXELIZER_SPOOL_DIR", str(tmp_path / "spool")) + monkeypatch.setenv("GC_ACCESS_MODE", "heimdall") + monkeypatch.setenv("GC_ACCESS_HEIMDALL_BASE_URL", "https://heimdall.gamecult.org") + monkeypatch.setenv("GC_ACCESS_APP_PUBLIC_BASE_URL", "https://repixelizer.gamecult.org") + monkeypatch.setenv("GC_ACCESS_ALLOWED_PROVIDERS", "discord") + + app = create_app() + css_status, css_headers, css_body = asyncio.run(_get_response(app, "/app/styles.css")) + logo_status, logo_headers, logo_body = asyncio.run( + _get_response(app, "/app/logos/repixelizer-logo-monogram.svg") + ) + + assert css_status == 200 + assert "text/css" in css_headers["content-type"] + assert b"body" in css_body + assert logo_status == 200 + assert "image/svg+xml" in logo_headers["content-type"] + assert b" None: from repixelizer.gui import create_app