mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-21 21:38:00 +00:00
353ea00736
Some checks are pending
CI / Focused test guidance (report-only) (push) Waiting to run
CI / Python syntax (compileall) (push) Waiting to run
CI / JS syntax (node --check) (push) Waiting to run
CI / Python tests (pytest 1/4) (push) Waiting to run
CI / Python tests (pytest 2/4) (push) Waiting to run
CI / Python tests (pytest 3/4) (push) Waiting to run
CI / Python tests (pytest 4/4) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
ci / docker publish / build (amd64) (push) Waiting to run
ci / docker publish / build (arm64) (push) Waiting to run
ci / docker publish / merge manifest + tag (push) Blocked by required conditions
* fix(auth): honor AUTH_ENABLED=false in admin-gated app-config routes With auth explicitly disabled (reverse-proxy deployments) there is no session user, so the inline admin checks in auth_routes.py returned 403 unconditionally and settings changes were silently lost. The central require_admin in core/middleware.py already allows this case; the inline checks did not. - add _require_admin_user helper mirroring require_admin semantics and use it in the app-config routes (settings, features, integrations) - return unscrubbed settings on GET /settings when auth is disabled (the caller is the operator) - settings.js: check res.ok in saveDefault so a failed save no longer reports 'Saved' - add regression tests User-management routes keep requiring a real admin identity; they act on the user store, which is not meaningful with auth disabled. Fixes #6028 * fix(settings): verify response.ok on save and expand auth regression tests - Ensure all settings save handlers in settings.js check response.ok before displaying success notifications, preventing false 'Saved' messages on server rejection. - Add DOM and JS unit tests verifying response.ok checks and error handling across settings handlers. - Expand tests/test_admin_routes_auth_disabled.py with comprehensive authorization test coverage for AUTH_ENABLED=false and AUTH_ENABLED=true across settings, features, integrations, secret scrubbing, and user management. --------- Co-authored-by: Alexandre Teixeira <111787685+alteixeira20@users.noreply.github.com> Co-authored-by: PR #6029 Reviewer <reviewer@odysseus-review.local> |
||
|---|---|---|
| .. | ||
| admin_wipe | ||
| cleanup | ||
| compare | ||
| contacts | ||
| document | ||
| gallery | ||
| history | ||
| mcp | ||
| memory | ||
| note | ||
| research | ||
| search | ||
| task | ||
| vault | ||
| webhook | ||
| __init__.py | ||
| _validators.py | ||
| admin_wipe_routes.py | ||
| api_token_routes.py | ||
| assistant_routes.py | ||
| auth_routes.py | ||
| backup_routes.py | ||
| calendar_routes.py | ||
| chat_helpers.py | ||
| chat_routes.py | ||
| chatgpt_subscription_routes.py | ||
| cleanup_routes.py | ||
| codex_routes.py | ||
| compare_routes.py | ||
| contacts_routes.py | ||
| cookbook_helpers.py | ||
| cookbook_output.py | ||
| cookbook_routes.py | ||
| copilot_routes.py | ||
| device_flow.py | ||
| diagnostics_routes.py | ||
| document_helpers.py | ||
| document_routes.py | ||
| editor_draft_routes.py | ||
| email_helpers.py | ||
| email_pollers.py | ||
| email_routes.py | ||
| embedding_routes.py | ||
| emoji_routes.py | ||
| font_routes.py | ||
| gallery_helpers.py | ||
| gallery_routes.py | ||
| history_routes.py | ||
| hwfit_routes.py | ||
| mcp_routes.py | ||
| memory_routes.py | ||
| model_routes.py | ||
| note_routes.py | ||
| personal_routes.py | ||
| prefs_routes.py | ||
| preset_routes.py | ||
| research_routes.py | ||
| search_routes.py | ||
| session_routes.py | ||
| shell_routes.py | ||
| signature_routes.py | ||
| skills_routes.py | ||
| stt_routes.py | ||
| task_routes.py | ||
| tts_routes.py | ||
| upload_routes.py | ||
| vault_routes.py | ||
| webhook_routes.py | ||
| workspace_routes.py | ||