From f70972cfb72462d3709a715e3b10a560f203bfcf Mon Sep 17 00:00:00 2001
From: Jeff Emmett <jeffemmett@gmail.com>
Date: Tue, 24 Mar 2026 10:32:18 -0700
Subject: [PATCH] fix(rdesign): add design-agent API to public endpoint
 exemptions

The demo space auth middleware was blocking POST requests with 403.
Add /rdesign/api/ to isPublicEndpoint list, matching rwallet pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 server/index.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/index.ts b/server/index.ts
index 8b9306e..87d0a94 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -2321,7 +2321,8 @@ for (const mod of getAllModules()) {
 			|| pathname.endsWith("/api/ramp/webhook")
 			|| pathname.includes("/rcart/api/payments")
 			|| pathname.includes("/rcart/pay/")
-			|| pathname.includes("/rwallet/api/");
+			|| pathname.includes("/rwallet/api/")
+			|| pathname.includes("/rdesign/api/");
 
 		if (!isHtmlRequest && !isPublicEndpoint && (vis === "private" || vis === "permissioned")) {
 			const token = extractToken(c.req.raw.headers);