From 18e891f94e922a249691c442ac33b8bc97f21a14 Mon Sep 17 00:00:00 2001 From: Mitchell Scott Date: Wed, 26 Aug 2026 07:34:17 -0600 Subject: [PATCH] fix: single-user auth gate --- internal/auth/auth.go | 7 +++++-- internal/auth/middleware.go | 8 +------- 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/internal/auth/auth.go b/internal/auth/auth.go index 64e6bfa8..c9d8537c 100644 --- a/internal/auth/auth.go +++ b/internal/auth/auth.go @@ -273,10 +273,13 @@ func CheckAuthHandler(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"authenticated": authenticated}) } -// AuthRequired checks if API authentication is configured +// AuthRequired checks if single-user authentication is configured, by either +// an API key or a username/password pair. func AuthRequired() bool { envApiKey := config.Get("API_KEY", "") - return envApiKey != "" + envUsername := config.Get("AUTH_USERNAME", "") + envPassword := config.Get("AUTH_PASSWORD", "") + return envApiKey != "" || (envUsername != "" && envPassword != "") } // CheckSingleUserPaired checks if rmapi.conf exists for single-user mode diff --git a/internal/auth/middleware.go b/internal/auth/middleware.go index d5aa9f56..f74dc079 100644 --- a/internal/auth/middleware.go +++ b/internal/auth/middleware.go @@ -7,7 +7,6 @@ import ( "github.com/gin-gonic/gin" "github.com/golang-jwt/jwt/v5" "github.com/google/uuid" - "github.com/rmitchellscott/aviary/internal/config" "github.com/rmitchellscott/aviary/internal/database" ) @@ -84,12 +83,7 @@ func OptionalAuthMiddleware() gin.HandlerFunc { return func(c *gin.Context) { if !database.IsMultiUserMode() { // In single-user mode, skip auth if not configured - envApiKey := config.Get("API_KEY", "") - envUsername := config.Get("AUTH_USERNAME", "") - envPassword := config.Get("AUTH_PASSWORD", "") - authConfigured := envApiKey != "" || (envUsername != "" && envPassword != "") - - if !authConfigured { + if !AuthRequired() { c.Next() return }