mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-11 22:12:23 +00:00
rcourtman
425ea00ba2
Users upgrading from v4.25 (where DISABLE_AUTH actually disabled auth) to v4.27.1 (where DISABLE_AUTH is ignored but triggers a deprecation warning) were stuck in a catch-22: - They had no credentials (old version had auth disabled) - DISABLE_AUTH detection incorrectly required authentication - Setup wizard returned 401, preventing first credential creation - Could not complete setup to create credentials and remove flag Root cause: When DISABLE_AUTH was detected, the code set forceRequested=true which triggered the authentication requirement even when authConfigured=false. Fix: Only require authentication when credentials actually exist. When no auth is configured, allow the bootstrap token flow regardless of whether DISABLE_AUTH is detected. This lets users upgrade from legacy DISABLE_AUTH deployments by using the bootstrap token to create their first credentials, then removing the flag.