mudler's LocalAI [bot]andEttore Di Giacinto 0ab632b6bd fix(auth): protect HTTP routes by default (#11602) ...

* fix(auth): default to protected HTTP routes

Use a method-aware registry for the small anonymous bootstrap surface.
Unknown routes now require credentials instead of inheriting fail-open
path classification.

Keep node self-service routes behind their registration-token middleware.
Global auth no longer rejects valid worker credentials first.

Assisted-by: Codex:gpt-5

* docs(auth): document public HTTP surface

Assisted-by: Codex:gpt-5

* test(auth): align route coverage with default denial

Assisted-by: Codex:gpt-5

---------

Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

2026-08-19 20:49:19 +02:00

..

agents.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

anthropic.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

auth_profile_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

auth_test.go

feat(usage): track and visualise usage per API key (#9920)

2026-05-21 16:34:02 +02:00

auth.go

fix: correct scheme/host on self-referential URLs behind an HTTPS reverse proxy (#10482) (#10504)

2026-06-25 08:10:59 +02:00

cluster_capabilities.go

fix(distributed): backend discovery hid worker-installed backends behind the controller's filesystem (#10967)

2026-07-20 01:09:37 +02:00

elevenlabs.go

feat: migrate to echo and enable cancellation of non-streaming requests (#7270)

2025-11-14 22:57:53 +01:00

explorer.go

feat: migrate to echo and enable cancellation of non-streaming requests (#7270)

2025-11-14 22:57:53 +01:00

finetuning.go

fix(distributed): backend discovery hid worker-installed backends behind the controller's filesystem (#10967)

2026-07-20 01:09:37 +02:00

health_test.go

fix(http): make /readyz reflect startup readiness, plus gitignore and coverage-ratchet fixes (#10989)

2026-07-20 21:45:27 +02:00

health.go

fix(http): make /readyz reflect startup readiness, plus gitignore and coverage-ratchet fixes (#10989)

2026-07-20 21:45:27 +02:00

jina.go

feat(distributed): gated X-LocalAI-Node response header (middleware + wrapper) (#9976)

2026-05-25 10:51:48 +02:00

localai.go

feat(chat): add end-to-end context compression (#11556)

2026-08-18 11:31:03 +00:00

middleware.go

feat(router): make KNN a first-class classifier with a persisted, curated corpus (#10652)

2026-08-18 09:37:43 +02:00

nodes.go

feat(vram): per-node VRAM allocation budget (LOCALAI_VRAM_BUDGET) (#10833)

2026-07-15 09:58:45 +02:00

ollama.go

feat(pii): NER tier engine — privacy-filter.cpp backend + NER-centric PII filter (#10360)

2026-06-18 11:45:22 +01:00

openai.go

feat(chat): add end-to-end context compression (#11556)

2026-08-18 11:31:03 +00:00

openresponses.go

fix(openresponses): make responses visible and cancellable across replicas (#11000)

2026-07-20 23:06:33 +02:00

pii.go

feat(pii): NER tier engine — privacy-filter.cpp backend + NER-centric PII filter (#10360)

2026-06-18 11:45:22 +01:00

quantization.go

fix(distributed): backend discovery hid worker-installed backends behind the controller's filesystem (#10967)

2026-07-20 01:09:37 +02:00

swagger_theme.go

feat(ui): give Operate and Studio a front door, and fix two layout regressions (#11305)

2026-08-03 00:16:08 +02:00

ui_api_backends_test.go

feat: backend versioning, upgrade detection and auto-upgrade (#9315)

2026-04-11 22:31:15 +02:00

ui_api_internal_test.go

feat(llama-cpp): serve Qwen3-TTS through the llama.cpp backend (#11392)

2026-08-10 10:18:47 +02:00

ui_api_operations_backend_classification_test.go

fix(distributed): backend discovery hid GPU-only backends behind the controller's capability (#10947)

2026-07-19 07:53:46 +00:00

ui_api_operations_history_test.go

feat(ui): replace the stacked operations bar with a one-line strip and an Activity page (#11163)

2026-07-28 19:33:48 +02:00

ui_api_operations_test.go

feat(downloads): add resume-safe pause action (#11222)

2026-08-03 15:25:23 +02:00

ui_api_variants_test.go

feat(gallery): let one gallery entry offer several builds of the same model (#10943)

2026-07-20 18:43:02 +02:00

ui_api.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

ui_backend_gallery.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

ui_gallery.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

ui_pipeline_models_test.go

feat(realtime): Add Liquid Audio s2s model and assistant mode on talk page (#9801)

2026-05-13 21:57:27 +02:00

ui.go

feat(realtime): Add Liquid Audio s2s model and assistant mode on talk page (#9801)

2026-05-13 21:57:27 +02:00

usage_test.go

feat(middleware): Model routing, PII filtering, Cloud model proxies (#9802)

2026-05-25 09:28:27 +02:00

usage.go

feat(middleware): Model routing, PII filtering, Cloud model proxies (#9802)

2026-05-25 09:28:27 +02:00