| Line 110... |
Line 110... |
| 110 |
ProfitMandiConstants.URL_USER_GOOGLE_LOGIN + "/", ProfitMandiConstants.URL_VERIFY_OTP)
|
110 |
ProfitMandiConstants.URL_USER_GOOGLE_LOGIN + "/", ProfitMandiConstants.URL_VERIFY_OTP)
|
| 111 |
.excludePathPatterns("/store/token").excludePathPatterns("/gc/**").excludePathPatterns("/stores/**")
|
111 |
.excludePathPatterns("/store/token").excludePathPatterns("/gc/**").excludePathPatterns("/stores/**")
|
| 112 |
.excludePathPatterns(ProfitMandiConstants.URL_AI_LEAD_INTAKE)
|
112 |
.excludePathPatterns(ProfitMandiConstants.URL_AI_LEAD_INTAKE)
|
| 113 |
.excludePathPatterns("/v2/api-docs/**")
|
113 |
.excludePathPatterns("/v2/api-docs/**")
|
| 114 |
.excludePathPatterns("/cpass-test/**", "/cpass/wa-listen")
|
114 |
.excludePathPatterns("/cpass-test/**", "/cpass/wa-listen")
|
| - |
|
115 |
// Inbound gateway callback only. /botpenguin-test/** is deliberately NOT excluded:
|
| - |
|
116 |
// those endpoints send real messages from the business number, so they keep auth.
|
| - |
|
117 |
.excludePathPatterns("/botpenguin/wa-listen")
|
| 115 |
.excludePathPatterns("/external/**");
|
118 |
.excludePathPatterns("/external/**");
|
| 116 |
|
119 |
|
| 117 |
// third-party partner APIs: X-Api-Key auth only (docs page is open)
|
120 |
// third-party partner APIs: X-Api-Key auth only (docs page is open)
|
| 118 |
registry.addInterceptor(apiKeyInterceptor).addPathPatterns("/external/**")
|
121 |
registry.addInterceptor(apiKeyInterceptor).addPathPatterns("/external/**")
|
| 119 |
.excludePathPatterns("/external/v1/docs");
|
122 |
.excludePathPatterns("/external/v1/docs");
|