fix: allow access to /docs

[cdgamarose-nv]

No description provided.

[greptile-apps]

Greptile Summary

This PR adds /docs, /redoc, and /openapi.json to both EXTERNAL_ALLOWED_PATHS and AUTH_EXEMPT_PATHS so external clients can browse the API documentation without a token. The path-matching and middleware flow are correct — the three paths are exact-matched by _path_allowed and short-circuit at the auth-exempt check before any token logic runs.

Confidence Score: 5/5

Safe to merge — the logic is correct and the change is intentional; only a P2 security-posture note remains.

The three new paths are correctly added to both lists, path matching via exact equality works as expected for FastAPI's doc routes, and the middleware flow is unchanged. The only finding is a P2 advisory about public OpenAPI spec exposure, which is a deliberate design trade-off rather than a defect.

No files require special attention.

Security Review

• API schema exposure: /openapi.json is now exempt from authentication, making the full API surface publicly readable on external-facing deployments. No sensitive credentials are exposed, but endpoint enumeration becomes trivial for unauthenticated actors.

Important Files Changed

Filename	Overview
frontends/aiq_api/src/aiq_api/auth/middleware.py	Adds /docs, /redoc, and /openapi.json to both EXTERNAL_ALLOWED_PATHS and AUTH_EXEMPT_PATHS, granting unauthenticated external access to API documentation endpoints.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[External Request] --> B{_is_external?}
    B -- No --> C[Internal caller detection]
    C --> Z[Pass to app]
    B -- Yes --> D{_path_allowed?}
    D -- No --> E[404 Not Found]
    D -- Yes --> F{path in AUTH_EXEMPT_PATHS?}
    F -- Yes --> G[anonymous user, no token needed]
    G --> Z
    F -- No --> H{require_auth?}
    H -- No --> I[anonymous user]
    I --> Z
    H -- Yes --> J{Bearer token present?}
    J -- No --> K[401 Missing token]
    J -- Yes --> L{Token valid?}
    L -- No --> M[401 Invalid token]
    L -- Yes --> N[Authenticated user]
    N --> Z

Loading

_{Reviews (1): Last reviewed commit: "allow access to /docs" | Re-trigger Greptile}

[AjayThorve]

LGTM!