fix: match parameterized public auth routes

dashcaddy-api/src/security/csrf-protection.js

@@ -172,8 +172,16 @@ function csrfValidationMiddleware(req, res, next) {
     '/api/v1/system/update-notify'
   ];
 
-  const isExcluded = excludedPaths.some(path => req.path === path) ||
-                     req.path.startsWith('/api/v1/auth/gate/');
+  const isExcluded = excludedPaths.some(path => {
+    if (req.path === path) return true;
+    // Allow `:param` placeholders to match any single segment. Pre-existing
+    // bug — literal ':token' never matched real tokens — fixed under DC-053.
+    if (path.includes(':')) {
+      const pattern = '^' + path.replace(/:[A-Za-z_][A-Za-z0-9_]*/g, '[^/]+') + '$';
+      return new RegExp(pattern).test(req.path);
+    }
+    return false;
+  }) || req.path.startsWith('/api/v1/auth/gate/');
 
   if (isExcluded) {
     return next();

dashcaddy-api/src/utilities/middleware.js

@@ -392,6 +392,17 @@ module.exports = function configureMiddleware(app, {
   function isPublicRoute(req) {
     return PUBLIC_ROUTES.some(r => {
       if (r.method && req.method !== r.method) return false;
+      if (r.exact) {
+        // Exact string match, BUT allow `:param` placeholders in the
+        // PUBLIC_ROUTES entry to match any single path segment. This was a
+        // pre-existing bug — literal ':token' never matched real tokens —
+        // caught by DC-053 public share preview returning 401.
+        if (r.path.includes(':')) {
+          const pattern = '^' + r.path.replace(/:[A-Za-z_][A-Za-z0-9_]*/g, '[^/]+') + '$';
+          return new RegExp(pattern).test(req.path);
+        }
+        return req.path === r.path;
+      }
       return r.prefix ? req.path.startsWith(r.path) : req.path === r.path;
     });
   }