From 4d8564f56bd76f2a53ef91048fcb7315710e5190 Mon Sep 17 00:00:00 2001
From: NotAShelf <raf@notashelf.dev>
Date: Thu, 5 Feb 2026 22:30:08 +0300
Subject: [PATCH] fc-server: restore dashboard routes; add `extract_session`
 middleware

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I91b71875b936ba2a1efbede1cb1ed4886a6a6964
---
 crates/server/src/routes/dashboard.rs |  3 +--
 crates/server/src/routes/mod.rs       | 28 +++++++--------------------
 2 files changed, 8 insertions(+), 23 deletions(-)

diff --git a/crates/server/src/routes/dashboard.rs b/crates/server/src/routes/dashboard.rs
index 4b7928c..3d56b55 100644
--- a/crates/server/src/routes/dashboard.rs
+++ b/crates/server/src/routes/dashboard.rs
@@ -1207,8 +1207,7 @@ async fn logout_action(
     .into_response()
 }
 
-pub fn router(state: AppState) -> Router<AppState> {
-  let _ = state; // used by middleware layer in mod.rs
+pub fn router() -> Router<AppState> {
   Router::new()
     .route("/login", get(login_page).post(login_action))
     .route("/logout", axum::routing::post(logout_action))
diff --git a/crates/server/src/routes/mod.rs b/crates/server/src/routes/mod.rs
index ca676ba..bb7a807 100644
--- a/crates/server/src/routes/mod.rs
+++ b/crates/server/src/routes/mod.rs
@@ -126,8 +126,13 @@ pub fn router(state: AppState, config: &ServerConfig) -> Router {
   let mut app = Router::new()
         // Static assets
         .route("/static/style.css", get(serve_style_css))
-        // Dashboard routes with session extraction middleware
-.nest(
+        // Dashboard routes (SSR templates) with session extraction
+        .merge(dashboard::router().route_layer(middleware::from_fn_with_state(
+            state.clone(),
+            extract_session,
+        )))
+        // API routes
+        .nest(
             "/api/v1",
             Router::new()
                 .merge(projects::router())
@@ -151,25 +156,6 @@ pub fn router(state: AppState, config: &ServerConfig) -> Router {
         .merge(metrics::router())
         // Webhooks use their own HMAC auth, outside the API key gate
         .merge(webhooks::router())
-        // API routes with Bearer token auth
-        .nest(
-            "/api/v1",
-            Router::new()
-                .merge(projects::router())
-                .merge(jobsets::router())
-                .merge(evaluations::router())
-                .merge(builds::router())
-                .merge(logs::router())
-                .merge(auth::router())
-                .merge(search::router())
-                .merge(badges::router())
-                .merge(channels::router())
-                .merge(admin::router())
-                .route_layer(middleware::from_fn_with_state(
-                    state.clone(),
-                    require_api_key,
-                )),
-        )
         .layer(TraceLayer::new_for_http())
         .layer(cors_layer)
         .layer(RequestBodyLimitLayer::new(config.max_body_size))