Merge pull request #86 from ashim-hq/fix/issue-72-auth-false-admin

fix: prevent admin escalation when AUTH_ENABLED=false

apps/api/src/plugins/auth.ts

@@ -659,16 +659,14 @@ function isPublicRoute(url: string): boolean {
 
 export async function authMiddleware(app: FastifyInstance): Promise<void> {
   app.addHook("preHandler", async (request: FastifyRequest, reply: FastifyReply) => {
-    // When auth is disabled, attach the first admin user so requireAuth/requireAdmin pass
+    // When auth is disabled, attach a synthetic non-admin user so tools work
+    // but admin-only routes (user management, settings write, etc.) stay locked
     if (!env.AUTH_ENABLED) {
-      const adminUser = db.select().from(schema.users).where(eq(schema.users.role, "admin")).get();
-      if (adminUser) {
-        (request as FastifyRequest & { user?: AuthUser }).user = {
-          id: adminUser.id,
-          username: adminUser.username,
-          role: "admin",
-        };
-      }
+      (request as FastifyRequest & { user?: AuthUser }).user = {
+        id: "anonymous",
+        username: "anonymous",
+        role: "user",
+      };
       return;
     }
 

apps/web/src/hooks/use-auth.ts

@@ -11,19 +11,12 @@ interface AuthState {
   permissions: string[];
 }
 
-const ALL_PERMISSIONS = [
+const USER_PERMISSIONS = [
   "tools:use",
   "files:own",
-  "files:all",
   "apikeys:own",
-  "apikeys:all",
   "pipelines:own",
-  "pipelines:all",
   "settings:read",
-  "settings:write",
-  "users:manage",
-  "teams:manage",
-  "branding:manage",
 ];
 
 export function useAuth() {
@@ -51,8 +44,8 @@ export function useAuth() {
               authEnabled: false,
               isAuthenticated: true,
               mustChangePassword: false,
-              role: "admin",
-              permissions: ALL_PERMISSIONS,
+              role: "user",
+              permissions: USER_PERMISSIONS,
             });
           return;
         }