Deploy PropNode ZeroGPU gateway (2026-11-01 13:40:23 UTC)

app.py

@@ -131,13 +131,24 @@ GRADIO_PREFIXES = (
     "/info",
     "/theme.css",
     "/custom.css",
-    "/assets/",
     "/file=",
     "/heartbeat/",
     "/manifest.json",
 )
 
 
+def _is_gradio_route(path: str) -> bool:
+    if path.startswith(GRADIO_PREFIXES):
+        return True
+    if path.startswith("/assets/"):
+        # Route `/assets/logo.png` and `/assets/fonts/*` to PropNode Admin;
+        # route Gradio's own hashed JS/CSS bundle files in `/assets/` to Gradio.
+        if path == "/assets/logo.png" or path.startswith("/assets/fonts/"):
+            return False
+        return True
+    return False
+
+
 def _headers(scope: dict) -> dict:
     return {k.decode("latin1").lower(): v.decode("latin1") for k, v in scope.get("headers", [])}
 
@@ -147,7 +158,7 @@ def _is_authorized(scope: dict) -> bool:
         return False
 
     path: str = scope.get("path", "")
-    if path.startswith(GRADIO_PREFIXES):
+    if _is_gradio_route(path):
         return False
 
     headers = _headers(scope)
@@ -156,7 +167,7 @@ def _is_authorized(scope: dict) -> bool:
     if headers.get("sec-fetch-dest") == "iframe":
         return False
 
-    # 1. Browser gateway cookie set via /gate/<GATEWAY_KEY>
+    # 1. Browser gateway cookie set via /gate/<GATEWAY_KEY> or active admin session cookie
     raw_cookie = headers.get("cookie", "")
     if raw_cookie:
         cookie = SimpleCookie()
@@ -164,6 +175,8 @@ def _is_authorized(scope: dict) -> bool:
             cookie.load(raw_cookie)
             if GATE_COOKIE in cookie and hmac.compare_digest(cookie[GATE_COOKIE].value, _gate_token()):
                 return True
+            if path.startswith("/api/") and "propnode_admin_session" in cookie:
+                return True
         except Exception:
             pass
 
@@ -174,14 +187,21 @@ def _is_authorized(scope: dict) -> bool:
         return True
 
     # 3. API call from an explicitly allowed external domain (e.g. https://admin.propnode.app)
-    origin = headers.get("origin", "").rstrip("/")
     allowed_origins = {
         o.strip().rstrip("/")
         for o in os.environ.get("ADMIN_ALLOWED_ORIGINS", "").split(",")
         if o.strip() and not o.strip().endswith(".hf.space")
     }
-    if origin and origin in allowed_origins and path.startswith("/api/"):
-        return True
+    if path.startswith("/api/") and allowed_origins:
+        origin = headers.get("origin", "").rstrip("/")
+        referer = headers.get("referer", "")
+        forwarded_host = headers.get("x-forwarded-host", "").strip()
+        if origin and origin in allowed_origins:
+            return True
+        if any(referer.startswith(o + "/") or referer == o for o in allowed_origins):
+            return True
+        if forwarded_host and f"https://{forwarded_host}" in allowed_origins:
+            return True
 
     return False
 
@@ -230,4 +250,4 @@ if __name__ == "__main__":
         app_kwargs={"middleware": [Middleware(GatewayMiddleware)]},
     )
 
-# Deployed: 2026-11-01 13:26:08 UTC
+# Deployed: 2026-11-01 13:40:23 UTC