server: Bypass API Key validation for WebUI static bundle assets

tools/server/server-http.cpp

@@ -151,11 +151,22 @@ bool server_http_context::init(const common_params & params) {
             return true;
         }
 
-        // If path is public or is static file, skip validation
+        // If path is public, skip validation
         if (public_endpoints.find(req.path) != public_endpoints.end() || req.path == "/") {
             return true;
         }
 
+        // Skip validation for web UI static assets (they don't require API key)
+        {
+            static const std::unordered_set<std::string> static_assets = {
+                "/bundle.js", "/bundle.css", "/index.html",
+            };
+
+            if (static_assets.find(req.path) != static_assets.end()) {
+                return true;
+            }
+        }
+
         // Check for API key in the Authorization header
         std::string req_api_key = req.get_header_value("Authorization");
         if (req_api_key.empty()) {

tools/server/tests/unit/test_security.py

@@ -22,6 +22,16 @@ def test_access_public_endpoint(endpoint: str):
     assert "error" not in res.body
 
 
+@pytest.mark.parametrize("endpoint", ["/", "/bundle.js", "/bundle.css"])
+def test_access_static_assets_without_api_key(endpoint: str):
+    """Static web UI assets should not require API key authentication (issue #21229)"""
+    global server
+    server.start()
+    res = server.make_request("GET", endpoint)
+    assert res.status_code == 200
+    assert "error" not in res.body
+
+
 @pytest.mark.parametrize("api_key", [None, "invalid-key"])
 def test_incorrect_api_key(api_key: str):
     global server