Major refactor of frontend source tree such that paths better match where they are served.

passkey/fastapi/admin.py

@@ -36,7 +36,7 @@ async def general_exception_handler(_request, exc: Exception):
 
 @app.get("/")
 async def adminapp(request: Request, auth=AUTH_COOKIE):
-    return FileResponse(frontend.file("admin/index.html"))
+    return FileResponse(frontend.file("auth", "admin", "index.html"))
 
 
 # -------------------- Organizations --------------------

passkey/fastapi/api.py

@@ -10,7 +10,7 @@ from fastapi import (
     Request,
     Response,
 )
-from fastapi.responses import FileResponse, JSONResponse
+from fastapi.responses import JSONResponse
 from fastapi.security import HTTPBearer
 
 from passkey.util import frontend
@@ -36,12 +36,6 @@ app = FastAPI()
 app.mount("/user", user.app)
 
 
-@app.get("/restricted")
-async def restricted_view():
-    """Serve the restricted/authentication UI for iframe embedding."""
-    return FileResponse(frontend.file("restricted/api", "index.html"))
-
-
 @app.exception_handler(HTTPException)
 async def http_exception_handler(_request: Request, exc: HTTPException):
     """Ensure auth cookie is cleared on 401 responses (JSON responses only)."""
@@ -155,7 +149,7 @@ async def forward_authentication(
         return Response(status_code=204, headers=remote_headers)
     except HTTPException as e:
         # Let global handler clear cookie; still return HTML surface instead of JSON
-        html = frontend.file("restricted/forward", "index.html").read_bytes()
+        html = frontend.file("int", "restricted", "index.html").read_bytes()
         status = e.status_code
         # If 401 we still want cookie cleared; rely on handler by raising again not feasible (we need HTML)
         if status == 401:

passkey/fastapi/mainapp.py

@@ -55,9 +55,18 @@ app.mount("/auth/admin/", admin.app)
 app.mount("/auth/api/", api.app)
 app.mount("/auth/ws/", ws.app)
 app.mount(
-    "/auth/assets/", StaticFiles(directory=frontend.file("assets")), name="assets"
+    "/auth/assets/",
+    StaticFiles(directory=frontend.file("auth", "assets")),
+    name="assets",
 )
 
+
+@app.get("/auth/restricted")
+async def restricted_view():
+    """Serve the restricted/authentication UI for iframe embedding."""
+    return FileResponse(frontend.file("auth", "restricted", "index.html"))
+
+
 # Navigable URLs are defined here. We support both / and /auth/ as the base path
 # / is used on a dedicated auth site, /auth/ on app domains with auth
 
@@ -74,8 +83,8 @@ async def frontapp(request: Request, response: Response, auth=AUTH_COOKIE):
         cur_host = hostutil.normalize_host(request.headers.get("host"))
         cfg_normalized = hostutil.normalize_host(cfg_host)
         if cur_host and cfg_normalized and cur_host != cfg_normalized:
-            return FileResponse(frontend.file("host", "index.html"))
-    return FileResponse(frontend.file("index.html"))
+            return FileResponse(frontend.file("int", "host", "index.html"))
+    return FileResponse(frontend.file("auth", "index.html"))
 
 
 @app.get("/admin", include_in_schema=False)
@@ -96,4 +105,4 @@ async def reset_link(reset: str):
     """Serve the reset app directly with an injected reset token."""
     if not passphrase.is_well_formed(reset):
         raise HTTPException(status_code=404)
-    return FileResponse(frontend.file("reset", "index.html"))
+    return FileResponse(frontend.file("int", "reset", "index.html"))