mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-10-09 03:20:56 +00:00
710f9869f0
The demo router hardcoded AuthMode::Disabled, which caused /auth/config and /auth/me to lie and let demo endpoints be reached without a session whenever the fabro-demo=1 cookie was set. With the cookie set on a GitHub-configured server, /login rendered "Paste your dev token" with no input and no GitHub button because /auth/config returned empty methods. Have the demo router inherit the real AuthMode so demo mode is purely a data-source toggle: authentication is identical regardless of the cookie. Update the translate test that locked in the old bypass, add a companion test for the authed happy path, and add a regression test that /auth/config returns real methods under the demo cookie. As defense in depth, the login page now renders an explicit "no authentication method is configured" state when methods is empty instead of the misleading dev-token prompt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| app | ||
| public | ||
| scripts | ||
| .dockerignore | ||
| .gitignore | ||
| index.template.html | ||
| package.json | ||
| tsconfig.json | ||