From 6cfd5023f99067ab315f0b8cdb79441f49838bd2 Mon Sep 17 00:00:00 2001 From: clawbot Date: Fri, 20 Feb 2026 03:33:34 -0800 Subject: [PATCH] fix: SetupRequired middleware exempts health, static, and API routes (closes #108) --- internal/middleware/middleware.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/internal/middleware/middleware.go b/internal/middleware/middleware.go index 32a121c..4a57c31 100644 --- a/internal/middleware/middleware.go +++ b/internal/middleware/middleware.go @@ -411,8 +411,14 @@ func (m *Middleware) SetupRequired() func(http.Handler) http.Handler { } if setupRequired { - // Allow access to setup page - if request.URL.Path == "/setup" { + path := request.URL.Path + + // Allow access to setup page, health endpoint, static + // assets, and API routes even before setup is complete. + if path == "/setup" || + path == "/health" || + strings.HasPrefix(path, "/s/") || + strings.HasPrefix(path, "/api/") { next.ServeHTTP(writer, request) return