mudler's LocalAI [bot]andEttore Di Giacinto 0ab632b6bd fix(auth): protect HTTP routes by default (#11602) ...

* fix(auth): default to protected HTTP routes

Use a method-aware registry for the small anonymous bootstrap surface.
Unknown routes now require credentials instead of inheriting fail-open
path classification.

Keep node self-service routes behind their registration-token middleware.
Global auth no longer rejects valid worker credentials first.

Assisted-by: Codex:gpt-5

* docs(auth): document public HTTP surface

Assisted-by: Codex:gpt-5

* test(auth): align route coverage with default denial

Assisted-by: Codex:gpt-5

---------

Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

2026-08-19 20:49:19 +02:00

..

apikeys_test.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

apikeys.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

auth_suite_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

branding_routes_test.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

db_nosqlite.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

db_sqlite_test.go

fix(auth): make advisory locks dialect-aware and harden SQLite DSN (#10509)

2026-06-25 17:18:55 +02:00

db_sqlite.go

fix(auth): make advisory locks dialect-aware and harden SQLite DSN (#10509)

2026-06-25 17:18:55 +02:00

db_test.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

db.go

feat(usage): track and visualise usage per API key (#9920)

2026-05-21 16:34:02 +02:00

features_moderation_test.go

feat(api): add text moderation endpoint (#11316)

2026-08-03 18:03:46 +02:00

features.go

feat(api): add text moderation endpoint (#11316)

2026-08-03 18:03:46 +02:00

helpers_test.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

middleware_test.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

middleware.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

models.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

oauth_email_decision_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

oauth_email_decision.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

oauth_signing_algs_test.go

fix(auth): accept EC/PS/EdDSA-signed OIDC ID tokens, not just RS256 (#10736)

2026-07-08 15:24:29 +02:00

oauth.go

fix(auth): accept EC/PS/EdDSA-signed OIDC ID tokens, not just RS256 (#10736)

2026-07-08 15:24:29 +02:00

password_test.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

password.go

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

permissions.go

feat(api): add text moderation endpoint (#11316)

2026-08-03 18:03:46 +02:00

public_routes.go

fix(auth): protect HTTP routes by default (#11602)

2026-08-19 20:49:19 +02:00

quota.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

roles_test.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

roles.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

session_test.go

feat: add users and authentication support (#9061)

2026-03-19 21:40:51 +01:00

session.go

feat: add distributed mode (#9124)

2026-03-30 00:47:27 +02:00

usage_test.go

feat(usage): attribute Sources rows to user accounts in admin view (#9935)

2026-05-21 23:23:06 +02:00

usage.go

feat(middleware): Model routing, PII filtering, Cloud model proxies (#9802)

2026-05-25 09:28:27 +02:00

users_test.go

fix(auth): cascade user deletion across all owned data on PostgreSQL (#9702)

2026-05-07 08:28:58 +02:00

users.go

fix(auth): cascade user deletion across all owned data on PostgreSQL (#9702)

2026-05-07 08:28:58 +02:00