Fix: allow static files without auth, only protect /api/* routes

2026-05-13 17:03:03 +02:00
parent 7e3184d77c
commit 0b47d81c51
1 changed files with 2 additions and 1 deletions
--- a/src/server/middleware/auth.ts
+++ b/src/server/middleware/auth.ts
@@ -4,7 +4,8 @@ const AUTH_USERNAME = process.env.SERVER_USERNAME || 'admin';
 const AUTH_PASSWORD = process.env.SERVER_PASSWORD || 'aidio2024';

 export function basicAuth(req: Request, res: Response, next: NextFunction): void {
-  if (req.path === '/api/auth/login' || req.path === '/api/auth/check') {
+  // Allow login/check endpoints and all non-API routes (static files, HTML)
+  if (req.path === '/api/auth/login' || req.path === '/api/auth/check' || !req.path.startsWith('/api/')) {
    next();
    return;
  }