Implement restricted-api for JS-driven auth calls, examples added (WIP!). Layout and styling simplified.

passkey/fastapi/mainapp.py

@@ -101,6 +101,17 @@ async def admin_root(request: Request, auth=AUTH_COOKIE):
     return await admin.adminapp(request, auth)  # Delegated (enforces access control)
 
 
+@app.get("/auth/restricted")
+async def restricted_view():
+    return FileResponse(frontend.file("restricted", "index.html"))
+
+
+@app.get("/auth/restricted-api")
+async def restricted_api_view():
+    return FileResponse(frontend.file("restricted-api", "index.html"))
+
+
+# Note: this catch-all handler must be the last route defined
 @app.get("/{reset}")
 @app.get("/auth/{reset}")
 async def reset_link(reset: str):
@@ -108,9 +119,3 @@ async def reset_link(reset: str):
     if not passphrase.is_well_formed(reset):
         raise HTTPException(status_code=404)
     return FileResponse(frontend.file("reset", "index.html"))
-
-
-@app.get("/restricted", include_in_schema=False)
-@app.get("/auth/restricted", include_in_schema=False)
-async def restricted_view():
-    return FileResponse(frontend.file("restricted", "index.html"))

passkey/util/frontend.py

@@ -27,7 +27,7 @@ BUN_BUG = """\
 
 NO_FRONTEND = """\
 ┃
-┃ Note: only static build of the frontend is served at port 8078.
+┃ Note: only static build of the frontend is served at localhost:4402.
 ┃ The page will not update with frontend code changes.
 """