My website's image does not work with twitter cards (unclear issues with robots.txt)

Question

Problem

I am trying to properly set up metadata for a twitter summary card on my website. I have everything in place, but the card image is not showing.

I use Grav, but I guess it does not matter.

Setup

This is what I get when using https://cards-dev.twitter.com/validator on my website (https://replayer.app/)

INFO:  Page fetched successfully
INFO:  18 metatags were found
INFO:  twitter:card = summary tag found
INFO:  Card loaded successfully
WARN:  The image URL https://replayer.app/user/pages/01.home/web-app-on-phone-stand.png specified by the 'twitter:image' metatag may be restricted by the site's robots.txt file, which will prevent Twitter from fetching it.
WARN:  this card is redirected to https://replayer.app/en

The image is available at the given URL, I checked with a browser. The robots.txt is what I got from the initial install by Grav:

User-agent: *
Disallow: /backup/
Disallow: /bin/
Disallow: /cache/
Disallow: /grav/
Disallow: /logs/
Disallow: /system/
Disallow: /vendor/
Disallow: /user/
Allow: /user/pages/
Allow: /user/themes/
Allow: /user/images/
Allow: /
Allow: *.css$
Allow: *.js$
Allow: /system/*.js$

Since the image is in /user/pages/, and it's allowed I would expect no issues.

Question

Why does the twitter card validator complain, and the image is not showing on tweets, when the image is available, and not excluded by anything?

Notes

For reference, here's the output of the validator:

Note: I looked into

• Twitter card [summary_large_image] not displaying image, but they get no WARN message at all
• Twitter cards not showing when I tweet, but I explicitly talk about my setup, not the tweet itself

Answer 1

Per https://www.robotstxt.org/norobots-rfc.txt :

To evaluate if access to a URL is allowed, a robot must attempt to match the paths in Allow and Disallow lines against the URL, in the order they occur in the record. The first match found is used. If no match is found, the default assumption is that the URL is allowed.

You have:

User-agent: *

...

Disallow: /user/
Allow: /user/pages/
Allow: /user/themes/
Allow: /user/images/

So everything under /user/ is disallowed as this is the first match, including hence /user/images.

You may need to change the order of the directives.