modified app.py

app.py

@@ -130,7 +130,7 @@ async def shutdown_db():
 # -------------------------------------------------
 # 🔐 Global Auth Middleware
 # -------------------------------------------------
-PUBLIC_PATHS = ["/", "/health", "/gradio"]
+PUBLIC_PATHS = ["/health"]
 
 API_SECRET_TOKEN = os.getenv("API_SECRET_TOKEN")
 if not API_SECRET_TOKEN:
@@ -139,7 +139,7 @@ if not API_SECRET_TOKEN:
 @fastapi_app.middleware("http")
 async def auth_middleware(request: Request, call_next):
     path = request.url.path
-    if any(path.startswith(p) for p in PUBLIC_PATHS):
+    if path in PUBLIC_PATHS:  # exact match
         return await call_next(request)
 
     auth_header = request.headers.get("Authorization")