From ab5596ed70ac5ea8a809b69ab5dbc3b8f2b3d7ba Mon Sep 17 00:00:00 2001
From: redshift <213178690+1ftredsh@users.noreply.github.com>
Date: Thu, 2 Jul 2026 20:09:58 +0530
Subject: [PATCH] remove .well-known/ from Tinfoil attestation routing

Tinfoil's proxy server guide only requires /attestation (GET) and
/v1/chat/completions + /v1/responses (POST). The .well-known/ path was
never requested by Tinfoil and was incorrectly added to:
- _API_PATH_PREFIXES (prefix gate)
- the unauthenticated GET bypass branch
- the Tinfoil integration docs

Remove it from all three.
---
 docs/tinfoil-direct-integration.md |  4 ++--
 routstr/proxy.py                   | 11 ++++-------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/docs/tinfoil-direct-integration.md b/docs/tinfoil-direct-integration.md
index 22d1ab37..ce689203 100644
--- a/docs/tinfoil-direct-integration.md
+++ b/docs/tinfoil-direct-integration.md
@@ -410,8 +410,8 @@ and `routstr/upstream/ehbp.py`.
   - `forward_ehbp_x_cashu_request()`: if usage is available, computes the
     refund from actual cost instead of max cost.
 
-- `routstr/proxy.py`: `/attestation` and `/.well-known/` paths are forwarded
-  to all enabled upstreams without model/cost/auth lookups.
+- `routstr/proxy.py`: `/attestation` and `/tee/attestation` paths are forwarded
+  to Tinfoil upstreams without model/cost/auth lookups.
 
 ### Billing behavior
 
diff --git a/routstr/proxy.py b/routstr/proxy.py
index cd2369b2..593eea81 100644
--- a/routstr/proxy.py
+++ b/routstr/proxy.py
@@ -191,7 +191,6 @@ _API_PATH_PREFIXES = (
     "providers",
     "tee/",
     "attestation",
-    ".well-known/",
 )
 
 
@@ -234,14 +233,12 @@ async def proxy(
         else:
             model_id = request_body_dict.get("model", "unknown")
 
-    # /tee/*, /attestation and /.well-known/* GET requests don't map to models
-    # — forward without model/cost/auth lookups. Tinfoil attestation paths are
-    # routed only to Tinfoil providers so an unrelated upstream's 404 cannot
+    # /tee/* and /attestation GET requests don't map to models — forward
+    # without model/cost/auth lookups. Tinfoil attestation paths are routed
+    # only to Tinfoil providers so an unrelated upstream's 404 cannot
     # short-circuit before the attestation proxy is tried.
     if request.method == "GET" and (
-        path.startswith("tee/")
-        or path.startswith("attestation")
-        or path.startswith(".well-known/")
+        path.startswith("tee/") or path.startswith("attestation")
     ):
         selected_upstreams = _select_unauthenticated_get_upstreams(path, _upstreams)
         if not selected_upstreams: