SnapOtter

mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00

Files

T

ashim-hq 7047ce5fae fix: prevent admin escalation when AUTH_ENABLED=false

When auth was disabled, users could log out, reach the login page,
and authenticate with the default admin/admin credentials to gain
full admin privileges — defeating the purpose of AUTH_ENABLED=false.

Defense-in-depth fix across five layers:
- Skip ensureDefaultAdmin() when auth is disabled (no admin user seeded)
- Return 403 from POST /api/auth/login when auth is disabled
- Return synthetic anonymous user from GET /api/auth/session when auth is disabled
- Hide logout button in settings when auth is disabled
- Redirect /login and /change-password to / via AuthGuard when auth is disabled

Closes #90

2026-04-23 14:45:04 +08:00

public

Refactor code structure for improved readability and maintainability

2026-04-17 17:07:31 +08:00

src

fix: prevent admin escalation when AUTH_ENABLED=false

2026-04-23 14:45:04 +08:00

index.html

chore: rename Stirling-Image to ashim across entire codebase

2026-04-14 20:55:42 +08:00

package.json

feat: add frontend analytics wrapper and consent store