ashim-hq 7047ce5fae fix: prevent admin escalation when AUTH_ENABLED=false ...

When auth was disabled, users could log out, reach the login page,
and authenticate with the default admin/admin credentials to gain
full admin privileges — defeating the purpose of AUTH_ENABLED=false.

Defense-in-depth fix across five layers:
- Skip ensureDefaultAdmin() when auth is disabled (no admin user seeded)
- Return 403 from POST /api/auth/login when auth is disabled
- Return synthetic anonymous user from GET /api/auth/session when auth is disabled
- Hide logout button in settings when auth is disabled
- Redirect /login and /change-password to / via AuthGuard when auth is disabled

Closes #90

2026-04-23 14:45:04 +08:00

..

api

fix: prevent admin escalation when AUTH_ENABLED=false

2026-04-23 14:45:04 +08:00

docs

fix: Docker hardening, security, and deployment readiness for V1 (#82)

2026-04-21 10:19:08 +08:00

web

fix: prevent admin escalation when AUTH_ENABLED=false

2026-04-23 14:45:04 +08:00