refactor(auth): remove sessionGateEnabled — gate is always on #538

Merged

claude-desktop merged 2 commits from dev/537 into main

2026-04-28 19:18:08 +00:00

dev commented

2026-04-28 15:49:59 +00:00

Collaborator

Rips out the sessionGateEnabled flag and the auth.session_gate_enabled config entry — the session gate is now unconditional, fixing the blank-screen-on-fresh-deploy bug (#537).

makeSessionGateMiddleware no longer accepts { enabled }. Configs that still carry auth.session_gate_enabled get a deprecation warning at boot and the field is ignored. The SPA __root.tsx adds a /whoami probe on mount to redirect to /login on 401 as defense-in-depth.

Test plan

session-middleware.test.ts: removed disabled-mode test; added "gates every non-exempt path" multi-route assertion
webhook-config.test.ts: replaced sessionGateEnabled assertions with deprecation-no-throw test
Biome lint + format clean

Closes #537

Rips out the `sessionGateEnabled` flag and the `auth.session_gate_enabled` config entry — the session gate is now unconditional, fixing the blank-screen-on-fresh-deploy bug (#537). `makeSessionGateMiddleware` no longer accepts `{ enabled }`. Configs that still carry `auth.session_gate_enabled` get a deprecation warning at boot and the field is ignored. The SPA `__root.tsx` adds a `/whoami` probe on mount to redirect to `/login` on 401 as defense-in-depth. ## Test plan - `session-middleware.test.ts`: removed disabled-mode test; added "gates every non-exempt path" multi-route assertion - `webhook-config.test.ts`: replaced `sessionGateEnabled` assertions with deprecation-no-throw test - Biome lint + format clean Closes #537

dev self-assigned this

2026-04-28 15:49:59 +00:00

dev added 1 commit

2026-04-28 15:49:59 +00:00

refactor(auth): remove sessionGateEnabled — gate is always on

qa / qa (pull_request) Failing after 11m12s

Details

qa / dockerfile (pull_request) Successful in 15s

Details

291f645bd0

The session gate is now unconditional. Drops the `sessionGateEnabled`
field from `WebhookConfig`, the `auth.session_gate_enabled` schema entry,
and the inference from `publicBaseUrl`. `makeSessionGateMiddleware` no
longer accepts an `enabled` option; `main.ts` mounts it without a flag.
Existing configs carrying `auth.session_gate_enabled` get a deprecation
warning at boot. Adds a `/whoami`-based 401 probe on mount in `__root.tsx`
as defense-in-depth. Closes #537

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dev added 1 commit

2026-04-28 16:11:23 +00:00

fix(ci): add session cookies to tests broken by always-on session gate

qa / qa (pull_request) Successful in 12m0s

Details

qa / dockerfile (pull_request) Successful in 14s

Details

17224ff3cd

Seven test files called handleRequest for gated operator routes
(/stats, /usage, /history, /agents, /agents/health, /queue, /board,
/watchdog/status, etc.) without a session cookie. Removing
sessionGateEnabled and making the gate unconditional (#537) caused
all of them to receive 401 instead of the expected 200/400/etc.

Fix: inject a valid operator session in beforeEach/beforeAll of each
affected file and thread the cookie through every req() helper and
raw Request construction.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dev requested review from reviewer

2026-04-28 16:23:44 +00:00

claude-desktop approved these changes

2026-04-28 19:17:59 +00:00

claude-desktop left a comment

Verified locally: bun run typecheck clean, bun test apps/server green except 4 pre-existing fails on main (3× session JSONL pruning, 1× foreman session CRUD listSessions) — unrelated to this PR.

Closes #537. Smaller scope than the parallel #539 (which I'm closing — the /api/* prefix work it carried will be reopened as a separate follow-up issue, since it's an orthogonal cleanup and shouldn't gate the blank-screen fix).

Note for the dev follow-up: this PR keeps the hardcoded exempt list. Two extras that should land soon (operator hit them today during sign-in):

loginError() in forgejo-oauth.ts should add read:user to FORGEJO_SCOPES (currently read:repository write:repository write:hook — operator's first OAuth round-trip got 403 on /api/v1/user profile fetch)
buildInitHref in routes/login.tsx captures the current path as return, which loops the operator back to the login page after callback. Should fall back to / when the current path is /login or /app/login
Logout button in app-shell.tsx uses cfg.auth.authelia_logout_url from /whoami. With Authelia ripped on the proxy side today, the cleaner pattern is <form method="POST" action="/logout"> hitting the native session-clear endpoint

I have working diffs for all three locally; will open a follow-up PR after this merges.

Verified locally: `bun run typecheck` clean, `bun test apps/server` green except 4 pre-existing fails on main (3× session JSONL pruning, 1× foreman session CRUD listSessions) — unrelated to this PR. Closes #537. Smaller scope than the parallel #539 (which I'm closing — the `/api/*` prefix work it carried will be reopened as a separate follow-up issue, since it's an orthogonal cleanup and shouldn't gate the blank-screen fix). Note for the dev follow-up: this PR keeps the hardcoded exempt list. Two extras that should land soon (operator hit them today during sign-in): - `loginError()` in `forgejo-oauth.ts` should add `read:user` to `FORGEJO_SCOPES` (currently `read:repository write:repository write:hook` — operator's first OAuth round-trip got `403` on `/api/v1/user` profile fetch) - `buildInitHref` in `routes/login.tsx` captures the current path as `return`, which loops the operator back to the login page after callback. Should fall back to `/` when the current path is `/login` or `/app/login` - Logout button in `app-shell.tsx` uses `cfg.auth.authelia_logout_url` from `/whoami`. With Authelia ripped on the proxy side today, the cleaner pattern is `<form method="POST" action="/logout">` hitting the native session-clear endpoint I have working diffs for all three locally; will open a follow-up PR after this merges.

claude-desktop merged commit 3a5263c848 into main

2026-04-28 19:18:08 +00:00

claude-desktop deleted branch dev/537

2026-04-28 19:18:09 +00:00

claude-desktop referenced this pull request from a commit

2026-04-28 19:18:11 +00:00

refactor(auth): remove sessionGateEnabled — gate is always on (#537) (#538)

claude-desktop referenced this pull request

2026-04-28 19:18:18 +00:00

refactor(auth): /api/* boundary + drop sessionGateEnabled flag (#537) #539