fix: anonymous mode settings, permissions, and FK constraints (#135)

- Grant admin role to anonymous user when AUTH_ENABLED=false
- Add DEFAULT_TOOL_VIEW env var (sidebar|fullscreen)
- Hide auth-dependent settings sections when auth disabled
- Fix session endpoint to return admin role consistently
- Seed anonymous user row in DB to satisfy FK constraints
- Add 25 new tests covering anonymous mode behavior

Closes #135

apps/api/src/index.ts

@@ -15,7 +15,12 @@ import { buildCsp } from "./lib/csp.js";
 import { ensureAiDirs, recoverInterruptedInstalls } from "./lib/feature-status.js";
 import { shutdownWorkerPool } from "./lib/worker-pool.js";
 import { requirePermission } from "./permissions.js";
-import { authMiddleware, authRoutes, ensureDefaultAdmin } from "./plugins/auth.js";
+import {
+  authMiddleware,
+  authRoutes,
+  ensureAnonymousUser,
+  ensureDefaultAdmin,
+} from "./plugins/auth.js";
 import { oidcRoutes } from "./plugins/oidc.js";
 import { registerStatic } from "./plugins/static.js";
 import { registerUpload } from "./plugins/upload.js";
@@ -41,9 +46,10 @@ import { userFileRoutes } from "./routes/user-files.js";
 runMigrations();
 console.log("Database initialized");
 
-// Create default admin user if no users exist and auth is enabled
 if (env.AUTH_ENABLED) {
   await ensureDefaultAdmin();
+} else {
+  ensureAnonymousUser();
 }
 
 function ensureInstanceId() {
@@ -63,6 +69,7 @@ function ensureDefaultSettings() {
   const defaults: Record<string, string> = {
     defaultTheme: env.DEFAULT_THEME,
     defaultLocale: env.DEFAULT_LOCALE,
+    defaultToolView: env.DEFAULT_TOOL_VIEW,
   };
   for (const [key, value] of Object.entries(defaults)) {
     const existing = db.select().from(schema.settings).where(eq(schema.settings.key, key)).get();

apps/api/src/lib/env.ts

@@ -27,6 +27,7 @@ const envSchema = z
     WORKSPACE_PATH: z.string().default("./tmp/workspace"),
     DEFAULT_THEME: z.enum(["light", "dark", "system"]).default("light"),
     DEFAULT_LOCALE: z.string().default("en"),
+    DEFAULT_TOOL_VIEW: z.enum(["sidebar", "fullscreen"]).default("sidebar"),
     CORS_ORIGIN: z.string().default(""),
     MAX_USERS: z.coerce.number().default(0),
     LOG_LEVEL: z.enum(["fatal", "error", "warn", "info", "debug", "trace"]).default("info"),

apps/api/src/plugins/auth.ts

@@ -136,6 +136,22 @@ export function createSessionToken(): string {
 
 // ── Default admin creation ─────────────────────────────────────────
 
+export function ensureAnonymousUser(): void {
+  const existing = db.select().from(schema.users).where(eq(schema.users.id, "anonymous")).get();
+  if (existing) return;
+
+  db.insert(schema.users)
+    .values({
+      id: "anonymous",
+      username: "anonymous",
+      role: "admin",
+      mustChangePassword: false,
+      authProvider: "local",
+    })
+    .onConflictDoNothing()
+    .run();
+}
+
 export async function ensureDefaultAdmin(): Promise<void> {
   const existingUsers = db.select().from(schema.users).all();
   if (existingUsers.length > 0) return;
@@ -297,9 +313,9 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
         user: {
           id: "anonymous",
           username: "anonymous",
-          role: "user",
+          role: "admin",
           mustChangePassword: false,
-          permissions: getPermissions("user"),
+          permissions: getPermissions("admin"),
           analyticsEnabled: null,
           analyticsConsentShownAt: null,
           analyticsConsentRemindAt: null,
@@ -847,13 +863,11 @@ function isPublicRoute(url: string): boolean {
 
 export async function authMiddleware(app: FastifyInstance): Promise<void> {
   app.addHook("preHandler", async (request: FastifyRequest, reply: FastifyReply) => {
-    // When auth is disabled, attach a synthetic non-admin user so tools work
-    // but admin-only routes (user management, settings write, etc.) stay locked
     if (!env.AUTH_ENABLED) {
       (request as FastifyRequest & { user?: AuthUser }).user = {
         id: "anonymous",
         username: "anonymous",
-        role: "user",
+        role: "admin",
       };
       return;
     }