Moved the restricted-api iframe src to /auth/api/restricted and removed the endpoint of the other restricted app.

passkey/fastapi/api.py

@@ -10,7 +10,7 @@ from fastapi import (
     Request,
     Response,
 )
-from fastapi.responses import JSONResponse
+from fastapi.responses import FileResponse, JSONResponse
 from fastapi.security import HTTPBearer
 
 from passkey.util import frontend
@@ -36,6 +36,12 @@ app = FastAPI()
 app.mount("/user", user.app)
 
 
+@app.get("/restricted")
+async def restricted_view():
+    """Serve the restricted/authentication UI for iframe embedding."""
+    return FileResponse(frontend.file("restricted-api", "index.html"))
+
+
 @app.exception_handler(HTTPException)
 async def http_exception_handler(_request: Request, exc: HTTPException):
     """Ensure auth cookie is cleared on 401 responses (JSON responses only)."""

passkey/fastapi/mainapp.py

@@ -89,16 +89,6 @@ async def admin_root(request: Request, auth=AUTH_COOKIE):
     return await admin.adminapp(request, auth)  # Delegated to admin app
 
 
-@app.get("/auth/restricted")
-async def restricted_view():
-    return FileResponse(frontend.file("restricted", "index.html"))
-
-
-@app.get("/auth/restricted-api")
-async def restricted_api_view():
-    return FileResponse(frontend.file("restricted-api", "index.html"))
-
-
 # Note: this catch-all handler must be the last route defined
 @app.get("/{reset}")
 @app.get("/auth/{reset}")