maziggy c236fdc650 fix(auth): expose /api/v1/system/appliance through the auth middleware allowlist ...

The /system/appliance endpoint is fetched by the SPA's i18n bootstrap on
  mount to seed locale, hostname, timezone, and the chrony NTP-gate state
  BEFORE any login state exists. The route handler itself has no auth
  dependency and the test_route_auth_coverage allowlist correctly marks it
  public, but the global auth_middleware in main.py — which short-circuits
  every /api/ path not in PUBLIC_API_ROUTES — was never told about it.
  Result: every browser session on an auth-enabled install logged a 401
  on the appliance endpoint before login.

  Added /api/v1/system/appliance to PUBLIC_API_ROUTES with a comment
  pointing at the dual-list pattern so this doesn't drift again, and a
  regression test in TestAuthMiddlewarePublicRoutes that posts /auth/setup
  to turn auth on, then asserts the endpoint returns 200 with the
  documented shape (hostname / timezone / locale / time_synced fields all
  present).

2026-06-25 15:19:28 +02:00

..

_fixtures

feat(auth): proxy OIDC provider icons server-side (#1333) (#1342)

2026-05-15 08:50:37 +02:00

integration

fix(auth): expose /api/v1/system/appliance through the auth middleware allowlist

2026-06-25 15:19:28 +02:00

unit

fix(auth): expose /api/v1/system/appliance through the auth middleware allowlist

2026-06-25 15:19:28 +02:00

__init__.py

Add comprehensive automated testing infrastructure

2025-12-11 10:03:40 +01:00

conftest.py

feat(sponsor-prompt): in-app toast at earned milestones

2026-06-20 15:50:58 +02:00

pytest.ini

test(pytest): silence upstream starlette httpx2 deprecation noise

2026-05-30 14:19:19 +02:00