DISABLE_AUTH env var — design

Purpose

Add a dev-only DISABLE_AUTH environment variable that bypasses authentication and permission checks end-to-end (API + admin UI), so the app can be driven by tooling (e.g. browser automation) without a login step. Insecure by design; must default to off and be documented as such.

Backend

Config (src/config.rs) gains disable_auth: bool, read from DISABLE_AUTH. Truthy values: 1, true (case-insensitive). Default: false.
src/auth/middleware.rs gains authenticate_or_bypass(state, req):
- If state.config.disable_auth, return a synthetic super-admin Claims (sub: "dev-bypass", permissions: u128::MAX.to_string(), exp: usize::MAX) without inspecting the request at all.
- Otherwise, delegate to the existing extract_bearer + authenticate flow.
require_auth, require_super_admin, require_admin_query, require_admin_cache, and blacklist_layer switch from extract_bearer(...).ok_or(UNAUTHORIZED)? + authenticate(...) to authenticate_or_bypass(...), so the bypass applies uniformly (including blacklist bypass_mask checks, since the caller mask is u128::MAX).
New route GET /auth/config (src/routes/auth.rs), unauthenticated, returns {"disable_auth": bool} so the frontend can detect the mode.

Frontend

ui/src/stores/auth.ts: on first access, fetch GET /auth/config. If disable_auth is true, set an authDisabled ref and short-circuit isAuthenticated / isSuperAdmin / hasPermission to always report a fully-privileged, logged-in user — no token needed.
ui/src/router/index.ts: beforeEach awaits the auth store's boot check (memoized, runs once) before evaluating requiresAuth, so /admin/* routes never redirect to /login while the flag is set.
No changes to Login.vue itself; it simply becomes unreachable in this mode (redirect away from /login when already "authenticated").

Docs / plumbing

.env.example: add DISABLE_AUTH= (commented, default off) with a warning.
docker-compose.yml: add DISABLE_AUTH: ${DISABLE_AUTH:-false} under the api service environment.
README.md: add DISABLE_AUTH to the Configuration table, marked dev-only / insecure — do not use in production.

Out of scope

No change to /auth/login behavior when the flag is off.
No new permission bits or config for partial bypass (all-or-nothing).
No changes to how the FE issues investigation (separate task, done live with agent-browser after this lands).

2.5 KiB Raw Blame History