From 2f854ce35b5f7bb8d5710f57dc395bf12ccbf0b5 Mon Sep 17 00:00:00 2001
From: Kieran Klukas <kieran@dunkirk.sh>
Date: Thu, 18 Jun 2026 11:02:46 -0400
Subject: [PATCH] feat: make /models open and dont fetch keys on docs

---
 server/cmd/server/main.go         | 3 +++
 server/internal/api/web/models.go | 7 +++++++
 web/src/routes/docs/+page.svelte  | 9 +++------
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/server/cmd/server/main.go b/server/cmd/server/main.go
index 8191c5f..4ac5a1c 100644
--- a/server/cmd/server/main.go
+++ b/server/cmd/server/main.go
@@ -179,6 +179,9 @@ func main() {
 		Registry: reg,
 	}
 
+	// /api/models — public model catalog; no user-specific data.
+	r.Get("/api/models", apiSrv.HandleListModelsPublic)
+
 	// /api/* — cookie-authenticated, internal surface.
 	r.Route("/api", func(r chi.Router) {
 		r.Use(authSvc.Middleware)
diff --git a/server/internal/api/web/models.go b/server/internal/api/web/models.go
index 675d7c7..75e18a5 100644
--- a/server/internal/api/web/models.go
+++ b/server/internal/api/web/models.go
@@ -6,6 +6,13 @@ import (
 	"time"
 )
 
+// HandleListModelsPublic is the exported form of handleListModels for use
+// as a public (no-auth) route. The model catalog contains no user-specific
+// data so it's safe to serve without authentication.
+func (s *Server) HandleListModelsPublic(w http.ResponseWriter, r *http.Request) {
+	s.handleListModels(w, r)
+}
+
 // handleListModels returns the model catalog from the DB.
 // The catalog is populated (and refreshed hourly) by pool.ModelsRefresher.
 // We never do live pioneer fetches here — that keeps the endpoint fast and
diff --git a/web/src/routes/docs/+page.svelte b/web/src/routes/docs/+page.svelte
index 0b7a40c..2f1e152 100644
--- a/web/src/routes/docs/+page.svelte
+++ b/web/src/routes/docs/+page.svelte
@@ -1,27 +1,24 @@
 <script lang="ts">
-  import { listKeys, listModels, type APIKey, type Model } from '$lib/api';
+  import { listModels, type Model } from '$lib/api';
   import { highlight, type Lang } from '$lib/highlight';
   import { onMount } from 'svelte';
   import Copy from '@lucide/svelte/icons/copy';
   import Check from '@lucide/svelte/icons/check';
 
   let baseURL = $state('https://potluck.dunkirk.sh');
-  let keys = $state<APIKey[]>([]);
   let models = $state<Model[]>([]);
 
   onMount(async () => {
     baseURL = window.location.origin;
     try {
-      const [k, m] = await Promise.all([listKeys(), listModels()]);
-      keys = k;
+      const m = await listModels();
       models = m.models;
     } catch {
       // best-effort — page still works without them
     }
   });
 
-  let activeKey = $derived(keys.find(k => !k.revoked) ?? null);
-  let keyExample = $derived(activeKey?.masked ?? 'pot_mist_\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022_0jgPu');
+  let keyExample = 'pot_mist_\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022_0jgPu';
   let firstModel = $derived(models[0]?.id ?? 'claude-haiku-4-5');
 
   // ---- copy-button state ------------------------------------------------
-- 
2.51.2