# DISABLE_AUTH env var — design

## Purpose

Add a dev-only `DISABLE_AUTH` environment variable that bypasses authentication
and permission checks end-to-end (API + admin UI), so the app can be driven
by tooling (e.g. browser automation) without a login step. Insecure by design;
must default to off and be documented as such.

## Backend

- `Config` (`src/config.rs`) gains `disable_auth: bool`, read from `DISABLE_AUTH`.
  Truthy values: `1`, `true` (case-insensitive). Default: `false`.
- `src/auth/middleware.rs` gains `authenticate_or_bypass(state, req)`:
  - If `state.config.disable_auth`, return a synthetic super-admin `Claims`
    (`sub: "dev-bypass"`, `permissions: u128::MAX.to_string()`, `exp: usize::MAX`)
    without inspecting the request at all.
  - Otherwise, delegate to the existing `extract_bearer` + `authenticate` flow.
- `require_auth`, `require_super_admin`, `require_admin_query`,
  `require_admin_cache`, and `blacklist_layer` switch from
  `extract_bearer(...).ok_or(UNAUTHORIZED)?` + `authenticate(...)` to
  `authenticate_or_bypass(...)`, so the bypass applies uniformly (including
  blacklist `bypass_mask` checks, since the caller mask is `u128::MAX`).
- New route `GET /auth/config` (`src/routes/auth.rs`), unauthenticated,
  returns `{"disable_auth": bool}` so the frontend can detect the mode.

## Frontend

- `ui/src/stores/auth.ts`: on first access, fetch `GET /auth/config`. If
  `disable_auth` is `true`, set an `authDisabled` ref and short-circuit
  `isAuthenticated` / `isSuperAdmin` / `hasPermission` to always report a
  fully-privileged, logged-in user — no token needed.
- `ui/src/router/index.ts`: `beforeEach` awaits the auth store's boot check
  (memoized, runs once) before evaluating `requiresAuth`, so `/admin/*`
  routes never redirect to `/login` while the flag is set.
- No changes to `Login.vue` itself; it simply becomes unreachable in this mode
  (redirect away from `/login` when already "authenticated").

## Docs / plumbing

- `.env.example`: add `DISABLE_AUTH=` (commented, default off) with a warning.
- `docker-compose.yml`: add `DISABLE_AUTH: ${DISABLE_AUTH:-false}` under the
  `api` service environment.
- `README.md`: add `DISABLE_AUTH` to the Configuration table, marked
  dev-only / insecure — do not use in production.

## Out of scope

- No change to `/auth/login` behavior when the flag is off.
- No new permission bits or config for partial bypass (all-or-nothing).
- No changes to how the FE issues investigation (separate task, done live
  with agent-browser after this lands).