shelfmark

mirror of https://github.com/calibrain/shelfmark.git synced 2026-09-27 22:05:56 +01:00

Files

T

CaliBrain ece6b8f341 fix(auth): fail closed when auth prerequisites are missing (#1387 ) (#1397 )

Auth mode resolution fell back to "none" (anonymous full admin) whenever
the configured method's prerequisites were missing: no local password
admin for builtin/OIDC, no Calibre-Web database, a blank proxy header,
an
unrecognized AUTH_METHOD (including "OIDC" in uppercase), or any error
while reading the config. Deleting or demoting the last local admin was
allowed on purpose because of that fallback, which exposed OIDC
instances publicly.

- Only an explicit AUTH_METHOD=none disables authentication. A
configured
  method stays active when its prerequisites are missing, so sign-in
  fails instead of opening up.
- An unrecognized or unreadable AUTH_METHOD resolves to "unavailable",
  which still requires a session and accepts no login. Values are
  normalized, so AUTH_METHOD=OIDC works.
- Restore the guard against deleting or demoting the last local password
  admin while builtin/OIDC is active (unless DISABLE_LOCAL_AUTH is set).
- Require a local admin before enabling Local auth, as OIDC already did.
- Log a recovery hint at startup when builtin/OIDC runs without a local
  admin, and document recovery via AUTH_METHOD=none.
- Drop the "will fall back to No Authentication" UI toasts and hints.



Fixes https://github.com/calibrain/shelfmark/issues/1387

2026-09-25 18:56:16 -04:00

dev

feat(packs): inspect multi-book releases and file each book separately (#1270 )

2026-08-27 00:40:08 -04:00

api-access.md

fix(auth): rename the API_KEY env var to SHELFMARK_API_KEY (#1374 )

2026-09-21 00:10:10 -04:00

configuration.md

path timeouts (#1103 )

2026-07-06 01:51:58 -04:00

custom-scripts.md

Fix JSON script blocking behavior + tests (#862 )