Commit Graph
4 Commits
Author SHA1 Message Date
MarSeventh 9fb3cf723a fix: fail closed when security config is unavailable 2026-06-09 19:22:31 +08:00
MarSeventh 3f995f6820 fix: sessionCheck adminRequired should also consider password-only config 2026-04-18 16:23:20 +08:00
MarSeventh 4d2796f54a refactor: unify auth logic into authCore with authScope parameter
- Extract shared authentication logic into utils/auth/authCore.js
- Replace enableBasicAuth/enableAuthCode flags with clear authScope enum (ADMIN/USER/EITHER)
- Move all auth-related files into utils/auth/ subdirectory
- Eliminate duplicated admin auth logic between _middleware.js and dualAuth.js
- Fix: user session no longer grants access to admin-only endpoints
- Fix: dualAuth no longer bypasses authCode when admin is not configured
- Update all 17 import references across the codebase
- Preserve original function signatures (userAuthCheck, dualAuthCheck) for zero caller changes
2026-04-18 13:24:53 +08:00
MarSeventh 61181b54ed refactor: move auth endpoints to /api/auth/ subdirectory
- login.js -> auth/login.js (/api/auth/login)
- logout.js -> auth/logout.js (/api/auth/logout)
- sessionCheck.js -> auth/sessionCheck.js (/api/auth/sessionCheck)
- resetAuth.js -> auth/resetAuth.js (/api/auth/resetAuth)
- Update import paths in moved files
2026-04-17 23:46:24 +08:00