jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions 3

Add AUTH_DEV_AUTOLOGIN to switch off the login on development instances

Browse source 
With AUTH_DEV_AUTOLOGIN=<username>, every /api request without a valid
session runs as that existing, active user and skips the forced password
change. Unset keeps the normal login; unknown or deactivated users still
get 401, real sessions take precedence, the CSRF application header stays
mandatory and the API logs a warning at startup. The switch is not
limited to localhost because the development instance is reached from
other machines and through a reverse proxy (THREATMODEL D2/R15). It must
never be set on an instance with real project data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Julian Appel 2026-10-30 09:03:29 +01:00
parent 4677b1685c
commit 084002bea9
11 changed files with 211 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

6
AGENTS.md
View file

@ -45,7 +45,11 @@ It must support circuits, device rows, project devices, drag-and-drop restructur
(`src/app/layout.tsx`). Every unsafe API request also requires the explicit
`X-Leistungsbilanz-Request: 1` application header, including over plain HTTP.
Account settings are available to every signed-in user; user administration
remains admin-only. See `docs/authentication.md` for the full picture.
remains admin-only. Development instances only: `AUTH_DEV_AUTOLOGIN=<username>`
signs every request without a session in as that existing active user
(login off, no forced password change; THREATMODEL D2/R15, never on
instances with real project data). See `docs/authentication.md` for the full
picture.
The supported runtime model is Circuit-First. The former Consumer UI, API,
tables and upgrade tooling are removed; do not reintroduce them.