From 06d193f0d98ea909c9069a360e90ce2ba0e4b7cb Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Sat, 28 Feb 2026 11:16:23 -0300 Subject: [PATCH] fix: prevent auth bypass after onboarding (#151) The 'no password' auth bypass check was meant for fresh installs only, but it also fired after onboarding was complete if the password row was missing from the database (e.g. after DB migration in v1.6.3). Fix: Added !settings.setupComplete guard so the bypass only applies before onboarding is done. Once setupComplete=true, auth is always required regardless of whether the password key exists in the DB. Files changed: - src/proxy.ts (dashboard middleware) - src/shared/utils/apiAuth.ts (isAuthRequired) --- src/proxy.ts | 6 +++--- src/shared/utils/apiAuth.ts | 6 ++++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/src/proxy.ts b/src/proxy.ts index 413f16815c..7f3cd981f3 100644 --- a/src/proxy.ts +++ b/src/proxy.ts @@ -131,9 +131,9 @@ export async function proxy(request) { if (settings.requireLogin === false) { return response; } - // Skip auth if no password has been set yet (fresh install with no env override) - // This prevents an unresolvable loop where requireLogin=true but no password exists - if (!settings.password && !process.env.INITIAL_PASSWORD) { + // Skip auth ONLY for fresh installs (before onboarding) where no password exists yet. + // Once setupComplete is true, always require auth — prevents bypass if password row is lost (#151) + if (!settings.setupComplete && !settings.password && !process.env.INITIAL_PASSWORD) { return response; } } catch (err) { diff --git a/src/shared/utils/apiAuth.ts b/src/shared/utils/apiAuth.ts index b9e8770192..55ab0b091d 100644 --- a/src/shared/utils/apiAuth.ts +++ b/src/shared/utils/apiAuth.ts @@ -134,8 +134,10 @@ export async function isAuthRequired(): Promise { try { const settings = await getSettings(); if (settings.requireLogin === false) return false; - // If no password set and no env override, don't require auth (fresh install) - if (!settings.password && !process.env.INITIAL_PASSWORD) return false; + // Only skip auth for fresh installs (not yet onboarded) with no password. + // Once setupComplete is true, always require auth — prevents bypass if password row is lost (#151) + if (!settings.setupComplete && !settings.password && !process.env.INITIAL_PASSWORD) + return false; return true; } catch { // On error, require auth (secure by default)