fix: eliminate 307 redirects that break login and API calls behind HF proxy

The previous trailing-slash normalization in api.ts inadvertently broke
login (POST /auth/login/ → 307 → /auth/login, losing FormData).

Root cause: FastAPI routes defined as @router .get("/") only match paths
WITH trailing slash, causing 307 redirects for requests WITHOUT one.
Behind HuggingFace's reverse proxy, these redirects silently fail.

Fix: Change route definitions from "/" to "" so they match the exact
paths the frontend sends (no trailing slash). Revert the frontend
trailing-slash hack.

Routes fixed: prompt_config (GET, POST), integrations (GET),
workspaces (GET, POST), automations (GET).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/v1/automations.py

@@ -30,7 +30,7 @@ class BuilderPayload(BaseModel):
     steps: List[BuilderStep]
     publish: bool = False
 
-@router.get("/")
+@router.get("")
 async def list_flows(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(deps.get_current_user)

backend/app/api/v1/integrations.py

@@ -17,7 +17,7 @@ from app.core.modules import require_module_enabled, MODULE_INTEGRATIONS_CONNECT
 
 router = APIRouter()
 
-@router.get("/", response_model=ResponseEnvelope[List[IntegrationRead]], dependencies=[Depends(require_module_enabled(MODULE_INTEGRATIONS_CONNECT, "read"))])
+@router.get("", response_model=ResponseEnvelope[List[IntegrationRead]], dependencies=[Depends(require_module_enabled(MODULE_INTEGRATIONS_CONNECT, "read"))])
 async def list_integrations(
     db: AsyncSession = Depends(get_db),
     workspace: Workspace = Depends(deps.get_active_workspace),

backend/app/api/v1/prompt_config.py

@@ -50,7 +50,7 @@ def compile_prompt(data: Dict[str, Any]) -> str:
         
     return "\n".join(lines)
 
-@router.get("/", response_model=ResponseEnvelope[PromptConfigRead], dependencies=[Depends(require_module_enabled(MODULE_PROMPT_STUDIO, "read"))])
+@router.get("", response_model=ResponseEnvelope[PromptConfigRead], dependencies=[Depends(require_module_enabled(MODULE_PROMPT_STUDIO, "read"))])
 async def get_prompt_config(
     db: AsyncSession = Depends(get_db),
     workspace: Workspace = Depends(deps.get_active_workspace),
@@ -87,7 +87,7 @@ async def get_prompt_config(
 import logging
 logger = logging.getLogger(__name__)
 
-@router.post("/", response_model=ResponseEnvelope[PromptVersionRead], dependencies=[Depends(require_module_enabled(MODULE_PROMPT_STUDIO, "write"))])
+@router.post("", response_model=ResponseEnvelope[PromptVersionRead], dependencies=[Depends(require_module_enabled(MODULE_PROMPT_STUDIO, "write"))])
 async def create_prompt_version(
     *,
     db: AsyncSession = Depends(get_db),

backend/app/api/v1/workspaces.py

@@ -14,7 +14,7 @@ from app.schemas.envelope import ResponseEnvelope, wrap_data, wrap_error
 
 router = APIRouter()
 
-@router.post("/", response_model=ResponseEnvelope[WorkspaceRead])
+@router.post("", response_model=ResponseEnvelope[WorkspaceRead])
 async def create_workspace(
     *,
     db: AsyncSession = Depends(get_db),
@@ -36,7 +36,7 @@ async def create_workspace(
     await db.refresh(workspace)
     return wrap_data(workspace)
 
-@router.get("/", response_model=ResponseEnvelope[List[WorkspaceRead]])
+@router.get("", response_model=ResponseEnvelope[List[WorkspaceRead]])
 async def list_workspaces(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(deps.get_current_user)

frontend/src/lib/admin-api.ts

@@ -27,9 +27,7 @@ async function adminRequest<T = any>(
 ): Promise<ApiResponse<T>> {
     const base = getBaseUrl().replace(/\/$/, "");
     const cleanPath = path.startsWith("/") ? path : `/${path}`;
-    // Ensure trailing slash to prevent FastAPI 307 redirects
-    const normalizedPath = cleanPath.endsWith("/") ? cleanPath : `${cleanPath}/`;
-    const url = `${base}/api/v1${normalizedPath}`;
+    const url = `${base}/api/v1${cleanPath}`;
 
     const token = adminAuth.getToken();
     const headers = new Headers(options.headers || {});

frontend/src/lib/api.ts

@@ -50,10 +50,7 @@ class ApiClient {
         // Safe base URL with /api/v1 prefix - ALWAYS absolute
         const base = API_BASE_URL.replace(/\/$/, "");
         const cleanPath = path.startsWith("/") ? path : `/${path}`;
-        // Ensure trailing slash to prevent FastAPI 307 redirects which can fail
-        // behind reverse proxies (e.g. HuggingFace Spaces)
-        const normalizedPath = cleanPath.endsWith("/") ? cleanPath : `${cleanPath}/`;
-        const url = `${base}/api/v1${normalizedPath}`;
+        const url = `${base}/api/v1${cleanPath}`;
 
         const method = options.method || "GET";
         console.log(`[API] ${method} ${url}`);