From f199eeb997d4403fbf8ad691cf94ba4d31a83f5f Mon Sep 17 00:00:00 2001
From: Caffrey <sunhongwei0913@163.com>
Date: Mon, 13 Apr 2026 14:31:26 +0800
Subject: [PATCH] fix: remove session bootstrap frontend config from compose

Per reviewer feedback: exposing SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_* in the
compose without matching SKILLHUB_AUTH_SESSION_BOOTSTRAP_ENABLED on the server
would cause 403 errors when frontend attempts bootstrap.

Keep this PR focused on direct auth only. Bootstrap variables are still handled
in 30-runtime-config.sh with false defaults, so runtime-config.js will have
authSessionBootstrapEnabled: "false" and frontend will not trigger bootstrap.
---
 .env.release.example | 5 -----
 compose.release.yml  | 3 ---
 2 files changed, 8 deletions(-)

diff --git a/.env.release.example b/.env.release.example
index cacdf9ce..ffb6ca84 100644
--- a/.env.release.example
+++ b/.env.release.example
@@ -62,11 +62,6 @@ SKILLHUB_AUTH_DIRECT_ENABLED=false
 SKILLHUB_WEB_AUTH_DIRECT_ENABLED=false
 SKILLHUB_WEB_AUTH_DIRECT_PROVIDER=
 
-# Enterprise SSO session bootstrap (e.g. header-based SSO proxy).
-SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED=false
-SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER=
-SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO=false
-
 # Security scanner is enabled by default. Set to false to disable scanning.
 SKILLHUB_SECURITY_SCANNER_ENABLED=true
 
diff --git a/compose.release.yml b/compose.release.yml
index 93535e8f..e45b2069 100644
--- a/compose.release.yml
+++ b/compose.release.yml
@@ -106,9 +106,6 @@ services:
       SKILLHUB_PUBLIC_BASE_URL: ${SKILLHUB_PUBLIC_BASE_URL:-}
       SKILLHUB_WEB_AUTH_DIRECT_ENABLED: ${SKILLHUB_WEB_AUTH_DIRECT_ENABLED:-false}
       SKILLHUB_WEB_AUTH_DIRECT_PROVIDER: ${SKILLHUB_WEB_AUTH_DIRECT_PROVIDER:-}
-      SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED: ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_ENABLED:-false}
-      SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER: ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_PROVIDER:-}
-      SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO: ${SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_AUTO:-false}
     depends_on:
       server:
         condition: service_healthy