Merge pull request #67 from bouwe77/auth-exclude-static-folder

feat: static folder never requires an auth header

package.json

@@ -1,6 +1,6 @@
 {
   "name": "temba",
-  "version": "0.30.1",
+  "version": "0.30.2",
   "description": "Get a simple REST API with zero coding in less than 30 seconds (seriously).",
   "type": "module",
   "main": "dist/src/index.js",

src/index.ts

@@ -35,6 +35,13 @@ const createServer = (userConfig?: UserConfig) => {
   // Enable CORS for all requests.
   app.use(cors({ origin: true, credentials: true }))
 
+  // Serve a static folder, if configured.
+  // Because it is defined before the auth middleware, the static folder is served without authentication,
+  // because it is not convenient to add an auth header to a web page in the browser.
+  if (config.staticFolder) {
+    app.use(express.static(config.staticFolder))
+  }
+
   // If enabled, add auth middleware to all requests, and disable the tokens resource.
   if (isAuthEnabled()) {
     app.use(createAuthMiddleware(queries))
@@ -47,11 +54,6 @@ const createServer = (userConfig?: UserConfig) => {
     app.use(delayMiddleware)
   }
 
-  // Serve a static folder, if configured.
-  if (config.staticFolder) {
-    app.use(express.static(config.staticFolder))
-  }
-
   // On the root URL (with apiPrefix, if applicable) only a GET is allowed.
   const rootRouter = express.Router()
   const rootPath = config.apiPrefix ? `${config.apiPrefix}` : '/'