fix

backend/app/api/misc.py

@@ -1,7 +1,7 @@
-"""Glossary + Triggers routes."""
+"""Glossary + Triggers + public UI settings routes."""
 from __future__ import annotations
 
-from typing import List
+from typing import Any, Dict, List
 from uuid import UUID
 
 from sqlalchemy import select
@@ -11,12 +11,37 @@ from fastapi import APIRouter, Depends, HTTPException
 
 from app.db import get_db_dep
 from app.deps import get_current_user
-from app.models import DeferredTrigger, GlossaryEntry, Session, User, World
+from app.models import DeferredTrigger, GlossaryEntry, Session, Setting, User, World
 from app.schemas import GlossaryEntryOut, TriggerOut
 
 router = APIRouter(prefix="/api", tags=["misc"])
 
 
+# Public, unauthenticated UI settings (logo URL etc.) — used by the frontend
+# on the login/register/home pages BEFORE the user is authenticated, so the
+# branding (logo, eventually theme) shows up everywhere.
+#
+# Only a curated subset of settings is exposed here. Anything sensitive (api
+# keys, internal URLs, admin tokens) MUST stay behind /api/admin/settings.
+PUBLIC_SETTING_KEYS = ("ui.logo_url",)
+_PUBLIC_DEFAULTS: Dict[str, Any] = {"ui.logo_url": "/logo.png"}
+
+
+@router.get("/settings/public")
+async def get_public_settings(db: AsyncSession = Depends(get_db_dep)):
+    """Return UI settings that are safe to expose without authentication.
+
+    Used by the frontend to render the logo (and other public branding) on
+    every page, including login/register. The response shape is a flat
+    `{key: value}` dict.
+    """
+    out: Dict[str, Any] = dict(_PUBLIC_DEFAULTS)
+    rows = await db.execute(select(Setting).where(Setting.key.in_(PUBLIC_SETTING_KEYS)))
+    for row in rows.scalars().all():
+        out[row.key] = row.value
+    return out
+
+
 @router.get("/worlds/{world_id}/glossary", response_model=List[GlossaryEntryOut])
 async def list_glossary(
     world_id: UUID,