From 7b5056bce3a3253a86d2fcce27b3cab81af97017 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20Kr=C3=BChlmann?= <andreas@kruhlmann.dev>
Date: Thu, 8 Jan 2026 15:58:31 +0100
Subject: [PATCH] Allow public asset access

---
 .../java/dev/kruhlmann/imgfloat/config/SecurityConfig.java    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/main/java/dev/kruhlmann/imgfloat/config/SecurityConfig.java b/src/main/java/dev/kruhlmann/imgfloat/config/SecurityConfig.java
index a1ea42d..8407889 100644
--- a/src/main/java/dev/kruhlmann/imgfloat/config/SecurityConfig.java
+++ b/src/main/java/dev/kruhlmann/imgfloat/config/SecurityConfig.java
@@ -68,10 +68,14 @@ public class SecurityConfig {
                     .permitAll()
                     .requestMatchers(HttpMethod.GET, "/api/channels/*/assets/visible")
                     .permitAll()
+                    .requestMatchers(HttpMethod.GET, "/api/channels/*/assets")
+                    .permitAll()
                     .requestMatchers(HttpMethod.GET, "/api/channels/*/canvas")
                     .permitAll()
                     .requestMatchers(HttpMethod.GET, "/api/channels/*/assets/*/content")
                     .permitAll()
+                    .requestMatchers(HttpMethod.GET, "/api/channels/*/assets/*/preview")
+                    .permitAll()
                     .requestMatchers("/ws/**")
                     .permitAll()
                     .anyRequest()