Add a password-gated private instance mode for xaigen.

Keep Authentik on aigen, isolate library data per instance, and purge Comfy outputs from the desktop after they are saved on the server.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/auth/callback.get.ts

@@ -1,5 +1,5 @@
 export default defineEventHandler(async (event) => {
-  if (!authEnabled()) {
+  if (!oidcAuthEnabled()) {
     throw createError({ statusCode: 404, statusMessage: 'Auth is not enabled' })
   }
   const config = useRuntimeConfig()

server/api/auth/credentials.put.ts

@@ -0,0 +1,17 @@
+export default defineEventHandler(async (event) => {
+  if (!passwordAuthEnabled()) {
+    throw createError({ statusCode: 404, statusMessage: 'Password login is not enabled' })
+  }
+  const user = getSessionUser(event)
+  if (!user) throw createError({ statusCode: 401, statusMessage: 'Authentication required' })
+  const body = await readBody<{ username?: string; password?: string; currentPassword?: string }>(event)
+  const current = String(body?.currentPassword || '')
+  const nextUser = String(body?.username || '').trim()
+  const nextPass = String(body?.password || '')
+  if (!current) throw createError({ statusCode: 400, statusMessage: 'Current password is required' })
+  const matched = await verifyLocalLogin(publicUsername() || user.name || '', current)
+  if (!matched) throw createError({ statusCode: 401, statusMessage: 'Current password is incorrect' })
+  const updated = await updateCredentials(nextUser || matched, nextPass || current)
+  setSessionUser(event, { sub: user.sub, name: updated.username })
+  return { ok: true, username: updated.username }
+})

server/api/auth/login.get.ts

@@ -1,5 +1,9 @@
 export default defineEventHandler(async (event) => {
-  if (!authEnabled()) {
+  if (passwordAuthEnabled()) {
+    await sendRedirect(event, '/login', 302)
+    return
+  }
+  if (!oidcAuthEnabled()) {
     throw createError({ statusCode: 404, statusMessage: 'Auth is not enabled' })
   }
   const config = useRuntimeConfig()

server/api/auth/login.post.ts

@@ -0,0 +1,17 @@
+export default defineEventHandler(async (event) => {
+  if (!passwordAuthEnabled()) {
+    throw createError({ statusCode: 404, statusMessage: 'Password login is not enabled' })
+  }
+  assertLoginAllowed(event)
+  const body = await readBody<{ username?: string; password?: string }>(event)
+  const username = String(body?.username || '')
+  const password = String(body?.password || '')
+  const matched = await verifyLocalLogin(username, password)
+  if (!matched) {
+    recordLoginFailure(event)
+    throw createError({ statusCode: 401, statusMessage: 'Incorrect username or password' })
+  }
+  clearLoginFailures(event)
+  setSessionUser(event, { sub: `local:${privateInstanceId()}`, name: matched })
+  return { ok: true, user: { name: matched } }
+})

server/api/auth/me.get.ts

@@ -1,4 +1,9 @@
 export default defineEventHandler((event) => {
   const user = getSessionUser(event)
-  return { user, authEnabled: authEnabled() }
+  return {
+    user,
+    authEnabled: authEnabled(),
+    authMode: passwordAuthEnabled() ? 'password' : oidcAuthEnabled() ? 'oidc' : 'none',
+    instanceName: useRuntimeConfig().public.instanceName || 'AIGen'
+  }
 })

server/api/generate.post.ts

@@ -110,6 +110,7 @@ async function runGeneration(
   const done = watchComfyJob(job)
   job.status = 'uploading'
   const uploaded = await uploadImage(params.image)
+  if (job.library) job.library.imageName = uploaded.name
   emitJob(job, { type: 'status', message: 'Queueing MiniMax H3 job...', progress: 6 })
   await waitForComfySocket(job, 4000)
 
@@ -121,7 +122,8 @@ async function runGeneration(
     steps: params.steps,
     seed: params.seed,
     turbo: params.turbo,
-    length: params.length
+    length: params.length,
+    filenamePrefix: comfyFilenamePrefix()
   })
 
   const queued = await queuePrompt(graph, job.clientId)
@@ -143,7 +145,8 @@ async function runGeneration(
       steps: job.library.steps,
       turbo: job.library.turbo,
       seed: job.library.seed,
-      startedAt: job.startedAt
+      startedAt: job.startedAt,
+      imageName: job.library.imageName
     })
   }
   emitJob(job, { type: 'status', message: 'Job queued on ComfyUI', progress: 8 })

server/api/health.get.ts

@@ -2,7 +2,7 @@ export default defineEventHandler(async () => {
   const comfy = await probeComfy().catch(() => ({ ok: false, host: '' }))
   return {
     ok: true,
-    service: 'aigen',
+    service: useRuntimeConfig().public.instanceName || 'aigen',
     comfy
   }
 })