From 16ad193af22631d8013ddec2ff5a1d667f7d29ea Mon Sep 17 00:00:00 2001
From: Travis Garrison <travis@chiraqbookstore.com>
Date: Thu, 30 Jul 2026 15:02:57 +0400
Subject: [PATCH] fix(login): skip auth validation on new install to allow
 migration

On fresh installs with no DB version, login validation would fail
before migrations could run. Check MY_Migration::getCurrentVersion()
and bypass credential check when no version exists.

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>
---
 app/Controllers/Login.php | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/app/Controllers/Login.php b/app/Controllers/Login.php
index fae1f5e83..462e76828 100644
--- a/app/Controllers/Login.php
+++ b/app/Controllers/Login.php
@@ -76,19 +76,23 @@ class Login extends BaseController
 
     public function migrate(): ResponseInterface
     {
-        $rules = ['username' => 'required|login_check[data]'];
-        $messages = [
-            'username' => [
-                'required'    => lang('Login.required_username'),
-                'login_check' => lang('Login.invalid_username_and_password'),
-            ]
-        ];
+        $isNewInstall = !MY_Migration::getCurrentVersion();
 
-        if (!$this->validate($rules, $messages)) {
-            return $this->response->setJSON([
-                'success' => false,
-                'message' => lang('Login.invalid_username_and_password')
-            ])->setStatusCode(401);
+        if (!$isNewInstall) {
+            $rules = ['username' => 'required|login_check[data]'];
+            $messages = [
+                'username' => [
+                    'required'    => lang('Login.required_username'),
+                    'login_check' => lang('Login.invalid_username_and_password'),
+                ]
+            ];
+
+            if (!$this->validate($rules, $messages)) {
+                return $this->response->setJSON([
+                    'success' => false,
+                    'message' => lang('Login.invalid_username_and_password')
+                ])->setStatusCode(401);
+            }
         }
 
         try {