fix(auth): fixes unlimited access when no authentication is set up

2026-07-18 12:20:08 +02:00
parent b316804dfb
commit 7c6d396042
1 changed files with 8 additions and 0 deletions
@@ -41,6 +41,14 @@ internal static class AdminEndpoints
        {
            api.RequireAuthorization();
        }
+        else
+        {
+            api.AddEndpointFilter((context, next) =>
+                new ValueTask<object?>(
+                    Results.Json(
+                        new { error = "No authentication configured - authentication required to use the admin API" },
+                        statusCode: StatusCodes.Status403Forbidden)));
+        }

        api.MapGet("/summary", (HttpContext context, TunnelHub hub, ManagementStore store) =>
            Results.Json(BuildSummary(context.User, hub, store, settings)));