fix: disable API v1 write methods (closes #112)

Remove POST /apps, DELETE /apps/{id}, and POST /apps/{id}/deploy from
the API v1 route group. These endpoints used cookie-based session auth
without CSRF protection, creating a CSRF vulnerability.

Read-only endpoints (GET /apps, GET /apps/{id}, GET /apps/{id}/deployments),
login, and whoami are retained.

Removed handlers: HandleAPICreateApp, HandleAPIDeleteApp,
HandleAPITriggerDeploy, along with apiCreateRequest struct and
validateCreateRequest function.

Updated tests to use service layer directly for app creation in
remaining read-only endpoint tests.

internal/handlers/api.go

@@ -8,7 +8,6 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"git.eeqj.de/sneak/upaas/internal/models"
-	"git.eeqj.de/sneak/upaas/internal/service/app"
 )
 
 // apiAppResponse is the JSON representation of an app.
@@ -175,115 +174,6 @@ func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
 	}
 }
 
-// HandleAPICreateApp returns a handler that creates a new app.
-func (h *Handlers) HandleAPICreateApp() http.HandlerFunc {
-	type createRequest struct {
-		Name           string `json:"name"`
-		RepoURL        string `json:"repoUrl"`
-		Branch         string `json:"branch"`
-		DockerfilePath string `json:"dockerfilePath"`
-		DockerNetwork  string `json:"dockerNetwork"`
-		NtfyTopic      string `json:"ntfyTopic"`
-		SlackWebhook   string `json:"slackWebhook"`
-	}
-
-	return func(writer http.ResponseWriter, request *http.Request) {
-		var req createRequest
-
-		decodeErr := json.NewDecoder(request.Body).Decode(&req)
-		if decodeErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid JSON body"},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		if req.Name == "" || req.RepoURL == "" {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "name and repo_url are required"},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		nameErr := validateAppName(req.Name)
-		if nameErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid app name: " + nameErr.Error()},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		repoURLErr := validateRepoURL(req.RepoURL)
-		if repoURLErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid repository URL: " + repoURLErr.Error()},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		createdApp, createErr := h.appService.CreateApp(request.Context(), app.CreateAppInput{
-			Name:           req.Name,
-			RepoURL:        req.RepoURL,
-			Branch:         req.Branch,
-			DockerfilePath: req.DockerfilePath,
-			DockerNetwork:  req.DockerNetwork,
-			NtfyTopic:      req.NtfyTopic,
-			SlackWebhook:   req.SlackWebhook,
-		})
-		if createErr != nil {
-			h.log.Error("api: failed to create app", "error", createErr)
-			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to create app"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		h.respondJSON(writer, request, appToAPI(createdApp), http.StatusCreated)
-	}
-}
-
-// HandleAPIDeleteApp returns a handler that deletes an app.
-func (h *Handlers) HandleAPIDeleteApp() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, err := h.appService.GetApp(request.Context(), appID)
-		if err != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "internal server error"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		if application == nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
-				http.StatusNotFound)
-
-			return
-		}
-
-		deleteErr := h.appService.DeleteApp(request.Context(), application)
-		if deleteErr != nil {
-			h.log.Error("api: failed to delete app", "error", deleteErr)
-			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to delete app"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		h.respondJSON(writer, request,
-			map[string]string{"status": "deleted"}, http.StatusOK)
-	}
-}
-
 // deploymentsPageLimit is the default number of deployments per page.
 const deploymentsPageLimit = 20
 
@@ -330,35 +220,6 @@ func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
 	}
 }
 
-// HandleAPITriggerDeploy returns a handler that triggers a deployment for an app.
-func (h *Handlers) HandleAPITriggerDeploy() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, err := h.appService.GetApp(request.Context(), appID)
-		if err != nil || application == nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
-				http.StatusNotFound)
-
-			return
-		}
-
-		deployErr := h.deploy.Deploy(request.Context(), application, nil, true)
-		if deployErr != nil {
-			h.log.Error("api: failed to trigger deploy", "error", deployErr)
-			h.respondJSON(writer, request,
-				map[string]string{"error": deployErr.Error()},
-				http.StatusConflict)
-
-			return
-		}
-
-		h.respondJSON(writer, request,
-			map[string]string{"status": "deploying"}, http.StatusAccepted)
-	}
-}
-
 // HandleAPIWhoAmI returns a handler that shows the current authenticated user.
 func (h *Handlers) HandleAPIWhoAmI() http.HandlerFunc {
 	type whoAmIResponse struct {

internal/handlers/api_test.go

@@ -10,6 +10,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"git.eeqj.de/sneak/upaas/internal/service/app"
 )
 
 // apiRouter builds a chi router with the API routes using session auth middleware.
@@ -23,10 +25,7 @@ func apiRouter(tc *testContext) http.Handler {
 			apiR.Use(tc.middleware.APISessionAuth())
 			apiR.Get("/whoami", tc.handlers.HandleAPIWhoAmI())
 			apiR.Get("/apps", tc.handlers.HandleAPIListApps())
-			apiR.Post("/apps", tc.handlers.HandleAPICreateApp())
 			apiR.Get("/apps/{id}", tc.handlers.HandleAPIGetApp())
-			apiR.Delete("/apps/{id}", tc.handlers.HandleAPIDeleteApp())
-			apiR.Post("/apps/{id}/deploy", tc.handlers.HandleAPITriggerDeploy())
 			apiR.Get("/apps/{id}/deployments", tc.handlers.HandleAPIListDeployments())
 		})
 	})
@@ -62,23 +61,16 @@ func setupAPITest(t *testing.T) (*testContext, []*http.Cookie) {
 	return tc, cookies
 }
 
-// apiRequest makes an authenticated API request using session cookies.
+// apiGet makes an authenticated GET request using session cookies.
-func apiRequest(
+func apiGet(
 	t *testing.T,
 	tc *testContext,
 	cookies []*http.Cookie,
-	method, path string,
+	path string,
-	body string,
 ) *httptest.ResponseRecorder {
 	t.Helper()
 
-	var req *http.Request
+	req := httptest.NewRequest(http.MethodGet, path, nil)
-	if body != "" {
-		req = httptest.NewRequest(method, path, strings.NewReader(body))
-		req.Header.Set("Content-Type", "application/json")
-	} else {
-		req = httptest.NewRequest(method, path, nil)
-	}
 
 	for _, c := range cookies {
 		req.AddCookie(c)
@@ -175,7 +167,7 @@ func TestAPIWhoAmI(t *testing.T) {
 
 	tc, cookies := setupAPITest(t)
 
-	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/whoami", "")
+	rr := apiGet(t, tc, cookies, "/api/v1/whoami")
 	assert.Equal(t, http.StatusOK, rr.Code)
 
 	var resp map[string]any
@@ -188,7 +180,7 @@ func TestAPIListAppsEmpty(t *testing.T) {
 
 	tc, cookies := setupAPITest(t)
 
-	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps", "")
+	rr := apiGet(t, tc, cookies, "/api/v1/apps")
 	assert.Equal(t, http.StatusOK, rr.Code)
 
 	var apps []any
@@ -196,52 +188,23 @@ func TestAPIListAppsEmpty(t *testing.T) {
 	assert.Empty(t, apps)
 }
 
-func TestAPICreateApp(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"test-app","repoUrl":"https://github.com/example/repo"}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	assert.Equal(t, http.StatusCreated, rr.Code)
-
-	var app map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
-	assert.Equal(t, "test-app", app["name"])
-	assert.Equal(t, "pending", app["status"])
-}
-
-func TestAPICreateAppValidation(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"","repoUrl":""}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	assert.Equal(t, http.StatusBadRequest, rr.Code)
-}
-
 func TestAPIGetApp(t *testing.T) {
 	t.Parallel()
 
 	tc, cookies := setupAPITest(t)
 
-	body := `{"name":"my-app","repoUrl":"https://github.com/example/repo"}`
+	created, err := tc.appSvc.CreateApp(t.Context(), app.CreateAppInput{
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+		Name:    "my-app",
-	require.Equal(t, http.StatusCreated, rr.Code)
+		RepoURL: "https://github.com/example/repo",
+	})
+	require.NoError(t, err)
 
-	var created map[string]any
+	rr := apiGet(t, tc, cookies, "/api/v1/apps/"+created.ID)
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
-
-	appID, ok := created["id"].(string)
-	require.True(t, ok)
-
-	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
 	assert.Equal(t, http.StatusOK, rr.Code)
 
-	var app map[string]any
+	var resp map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
-	assert.Equal(t, "my-app", app["name"])
+	assert.Equal(t, "my-app", resp["name"])
 }
 
 func TestAPIGetAppNotFound(t *testing.T) {
@@ -249,29 +212,7 @@ func TestAPIGetAppNotFound(t *testing.T) {
 
 	tc, cookies := setupAPITest(t)
 
-	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/nonexistent", "")
+	rr := apiGet(t, tc, cookies, "/api/v1/apps/nonexistent")
-	assert.Equal(t, http.StatusNotFound, rr.Code)
-}
-
-func TestAPIDeleteApp(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"delete-me","repoUrl":"https://github.com/example/repo"}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	require.Equal(t, http.StatusCreated, rr.Code)
-
-	var created map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
-
-	appID, ok := created["id"].(string)
-	require.True(t, ok)
-
-	rr = apiRequest(t, tc, cookies, http.MethodDelete, "/api/v1/apps/"+appID, "")
-	assert.Equal(t, http.StatusOK, rr.Code)
-
-	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
 	assert.Equal(t, http.StatusNotFound, rr.Code)
 }
 
@@ -280,17 +221,13 @@ func TestAPIListDeployments(t *testing.T) {
 
 	tc, cookies := setupAPITest(t)
 
-	body := `{"name":"deploy-app","repoUrl":"https://github.com/example/repo"}`
+	created, err := tc.appSvc.CreateApp(t.Context(), app.CreateAppInput{
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+		Name:    "deploy-app",
-	require.Equal(t, http.StatusCreated, rr.Code)
+		RepoURL: "https://github.com/example/repo",
+	})
+	require.NoError(t, err)
 
-	var created map[string]any
+	rr := apiGet(t, tc, cookies, "/api/v1/apps/"+created.ID+"/deployments")
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
-
-	appID, ok := created["id"].(string)
-	require.True(t, ok)
-
-	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID+"/deployments", "")
 	assert.Equal(t, http.StatusOK, rr.Code)
 
 	var deployments []any

internal/handlers/app.go

@@ -916,7 +916,7 @@ func (h *Handlers) HandleEnvVarAdd() http.HandlerFunc {
 func (h *Handlers) HandleEnvVarDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
 		appID := chi.URLParam(request, "id")
-		envVarIDStr := chi.URLParam(request, "envID")
+		envVarIDStr := chi.URLParam(request, "varID")
 
 		envVarID, parseErr := strconv.ParseInt(envVarIDStr, 10, 64)
 		if parseErr != nil {
@@ -1022,6 +1022,14 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 			return
 		}
 
+		pathErr := validateVolumePaths(hostPath, containerPath)
+		if pathErr != nil {
+			h.log.Error("invalid volume path", "error", pathErr)
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+
+			return
+		}
+
 		volume := models.NewVolume(h.db)
 		volume.AppID = application.ID
 		volume.HostPath = hostPath

internal/handlers/export_test.go

@@ -0,0 +1,6 @@
+package handlers
+
+// ValidateRepoURLForTest exports validateRepoURL for testing.
+func ValidateRepoURLForTest(repoURL string) error {
+	return validateRepoURL(repoURL)
+}

internal/handlers/handlers_test.go

@@ -564,7 +564,7 @@ func TestDeleteEnvVarOwnershipVerification(t *testing.T) { //nolint:dupl // inte
 			return "/apps/" + appID + "/env/" + strconv.FormatInt(resourceID, 10) + "/delete"
 		},
 		chiParams: func(appID string, resourceID int64) map[string]string {
-			return map[string]string{"id": appID, "envID": strconv.FormatInt(resourceID, 10)}
+			return map[string]string{"id": appID, "varID": strconv.FormatInt(resourceID, 10)}
 		},
 		handler: func(h *handlers.Handlers) http.HandlerFunc { return h.HandleEnvVarDelete() },
 		verifyFn: func(t *testing.T, tc *testContext, resourceID int64) {
@@ -695,6 +695,153 @@ func TestDeletePortOwnershipVerification(t *testing.T) {
 	assert.NotNil(t, found, "port should still exist after IDOR attempt")
 }
 
+// TestHandleEnvVarDeleteUsesCorrectRouteParam verifies that HandleEnvVarDelete
+// reads the "varID" chi URL parameter (matching the route definition {varID}),
+// not a mismatched name like "envID".
+func TestHandleEnvVarDeleteUsesCorrectRouteParam(t *testing.T) {
+	t.Parallel()
+
+	testCtx := setupTestHandlers(t)
+
+	createdApp := createTestApp(t, testCtx, "envdelete-param-app")
+
+	envVar := models.NewEnvVar(testCtx.database)
+	envVar.AppID = createdApp.ID
+	envVar.Key = "DELETE_ME"
+	envVar.Value = "gone"
+	require.NoError(t, envVar.Save(context.Background()))
+
+	// Use chi router with the real route pattern to test param name
+	r := chi.NewRouter()
+	r.Post("/apps/{id}/env-vars/{varID}/delete", testCtx.handlers.HandleEnvVarDelete())
+
+	request := httptest.NewRequest(
+		http.MethodPost,
+		"/apps/"+createdApp.ID+"/env-vars/"+strconv.FormatInt(envVar.ID, 10)+"/delete",
+		nil,
+	)
+	recorder := httptest.NewRecorder()
+
+	r.ServeHTTP(recorder, request)
+
+	assert.Equal(t, http.StatusSeeOther, recorder.Code)
+
+	// Verify the env var was actually deleted
+	found, findErr := models.FindEnvVar(context.Background(), testCtx.database, envVar.ID)
+	require.NoError(t, findErr)
+	assert.Nil(t, found, "env var should be deleted when using correct route param")
+}
+
+// TestHandleVolumeAddValidatesPaths verifies that HandleVolumeAdd validates
+// host and container paths (same as HandleVolumeEdit).
+func TestHandleVolumeAddValidatesPaths(t *testing.T) {
+	t.Parallel()
+
+	testCtx := setupTestHandlers(t)
+
+	createdApp := createTestApp(t, testCtx, "volume-validate-app")
+
+	tests := []struct {
+		name          string
+		hostPath      string
+		containerPath string
+		shouldCreate  bool
+	}{
+		{"relative host path rejected", "relative/path", "/container", false},
+		{"relative container path rejected", "/host", "relative/path", false},
+		{"unclean host path rejected", "/host/../etc", "/container", false},
+		{"valid paths accepted", "/host/data", "/container/data", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			form := url.Values{}
+			form.Set("host_path", tt.hostPath)
+			form.Set("container_path", tt.containerPath)
+
+			request := httptest.NewRequest(
+				http.MethodPost,
+				"/apps/"+createdApp.ID+"/volumes",
+				strings.NewReader(form.Encode()),
+			)
+			request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			request = addChiURLParams(request, map[string]string{"id": createdApp.ID})
+
+			recorder := httptest.NewRecorder()
+
+			handler := testCtx.handlers.HandleVolumeAdd()
+			handler.ServeHTTP(recorder, request)
+
+			assert.Equal(t, http.StatusSeeOther, recorder.Code)
+
+			// Check if volume was created by listing volumes
+			volumes, _ := createdApp.GetVolumes(context.Background())
+			found := false
+
+			for _, v := range volumes {
+				if v.HostPath == tt.hostPath && v.ContainerPath == tt.containerPath {
+					found = true
+					// Clean up for isolation
+					_ = v.Delete(context.Background())
+				}
+			}
+
+			if tt.shouldCreate {
+				assert.True(t, found, "volume should be created for valid paths")
+			} else {
+				assert.False(t, found, "volume should NOT be created for invalid paths")
+			}
+		})
+	}
+}
+
+// TestSetupRequiredExemptsHealthAndStaticAndAPI verifies that the SetupRequired
+// middleware allows /health, /s/*, and /api/* paths through even when setup is required.
+func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
+	t.Parallel()
+
+	testCtx := setupTestHandlers(t)
+
+	// No user created, so setup IS required
+	mw := testCtx.middleware.SetupRequired()
+
+	okHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("OK"))
+	})
+
+	wrapped := mw(okHandler)
+
+	exemptPaths := []string{"/health", "/s/style.css", "/s/js/app.js", "/api/v1/apps", "/api/v1/login"}
+
+	for _, path := range exemptPaths {
+		t.Run(path, func(t *testing.T) {
+			t.Parallel()
+
+			req := httptest.NewRequest(http.MethodGet, path, nil)
+			rr := httptest.NewRecorder()
+			wrapped.ServeHTTP(rr, req)
+
+			assert.Equal(t, http.StatusOK, rr.Code,
+				"path %s should be exempt from setup redirect", path)
+		})
+	}
+
+	// Non-exempt path should redirect to /setup
+	t.Run("non-exempt redirects", func(t *testing.T) {
+		t.Parallel()
+
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		rr := httptest.NewRecorder()
+		wrapped.ServeHTTP(rr, req)
+
+		assert.Equal(t, http.StatusSeeOther, rr.Code)
+		assert.Equal(t, "/setup", rr.Header().Get("Location"))
+	})
+}
+
 func TestHandleCancelDeployRedirects(t *testing.T) {
 	t.Parallel()
 

internal/handlers/repo_url_validation.go

@@ -20,6 +20,16 @@ var (
 // Only the "git" user is allowed, as that is the standard for SSH deploy keys.
 var scpLikeRepoRe = regexp.MustCompile(`^git@[a-zA-Z0-9._-]+:.+$`)
 
+// allowedRepoSchemes lists the URL schemes accepted for repository URLs.
+//
+//nolint:gochecknoglobals // package-level constant map parsed once
+var allowedRepoSchemes = map[string]bool{
+	"https": true,
+	"http":  true,
+	"ssh":   true,
+	"git":   true,
+}
+
 // validateRepoURL checks that the given repository URL is valid and uses an allowed scheme.
 func validateRepoURL(repoURL string) error {
 	if strings.TrimSpace(repoURL) == "" {
@@ -41,17 +51,17 @@ func validateRepoURL(repoURL string) error {
 		return errRepoURLScheme
 	}
 
-	// Parse as standard URL
+	return validateParsedRepoURL(repoURL)
+}
+
+// validateParsedRepoURL validates a standard URL-format repository URL.
+func validateParsedRepoURL(repoURL string) error {
 	parsed, err := url.Parse(repoURL)
 	if err != nil {
 		return errRepoURLInvalid
 	}
 
-	// Must have a recognized scheme
+	if !allowedRepoSchemes[strings.ToLower(parsed.Scheme)] {
-	switch strings.ToLower(parsed.Scheme) {
-	case "https", "http", "ssh", "git":
-		// OK
-	default:
 		return errRepoURLInvalid
 	}
 

internal/handlers/repo_url_validation_test.go

@@ -1,6 +1,10 @@
-package handlers
+package handlers_test
 
-import "testing"
+import (
+	"testing"
+
+	"git.eeqj.de/sneak/upaas/internal/handlers"
+)
 
 func TestValidateRepoURL(t *testing.T) {
 	t.Parallel()
@@ -43,13 +47,13 @@ func TestValidateRepoURL(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			err := validateRepoURL(tc.url)
+			err := handlers.ValidateRepoURLForTest(tc.url)
 			if tc.wantErr && err == nil {
-				t.Errorf("validateRepoURL(%q) = nil, want error", tc.url)
+				t.Errorf("ValidateRepoURLForTest(%q) = nil, want error", tc.url)
 			}
 
 			if !tc.wantErr && err != nil {
-				t.Errorf("validateRepoURL(%q) = %v, want nil", tc.url, err)
+				t.Errorf("ValidateRepoURLForTest(%q) = %v, want nil", tc.url, err)
 			}
 		})
 	}

internal/middleware/middleware.go

@@ -411,8 +411,14 @@ func (m *Middleware) SetupRequired() func(http.Handler) http.Handler {
 			}
 
 			if setupRequired {
-				// Allow access to setup page
+				path := request.URL.Path
-				if request.URL.Path == "/setup" {
+
+				// Allow access to setup page, health endpoint, static
+				// assets, and API routes even before setup is complete.
+				if path == "/setup" ||
+					path == "/health" ||
+					strings.HasPrefix(path, "/s/") ||
+					strings.HasPrefix(path, "/api/") {
 					next.ServeHTTP(writer, request)
 
 					return

internal/server/routes.go

@@ -114,10 +114,7 @@ func (s *Server) SetupRoutes() {
 			r.Get("/whoami", s.handlers.HandleAPIWhoAmI())
 
 			r.Get("/apps", s.handlers.HandleAPIListApps())
-			r.Post("/apps", s.handlers.HandleAPICreateApp())
 			r.Get("/apps/{id}", s.handlers.HandleAPIGetApp())
-			r.Delete("/apps/{id}", s.handlers.HandleAPIDeleteApp())
-			r.Post("/apps/{id}/deploy", s.handlers.HandleAPITriggerDeploy())
 			r.Get("/apps/{id}/deployments", s.handlers.HandleAPIListDeployments())
 		})
 	})