TowstyandCursor
7bcd23fcc5
The 401 was the session wall, not a missing token. The ingest route now uses the shared Bearer secret, and both apps default that secret so Coolify vars are optional. Co-authored-by: Cursor <cursoragent@cursor.com>
25 lines
778 B
TypeScript
25 lines
778 B
TypeScript
export default defineEventHandler((event) => {
|
|
if (!authEnabled()) return
|
|
const path = event.path || getRequestURL(event).pathname
|
|
if (
|
|
path.startsWith('/api/auth/login') ||
|
|
path.startsWith('/api/auth/callback') ||
|
|
path.startsWith('/api/auth/logout') ||
|
|
path.startsWith('/api/auth/me') ||
|
|
path.startsWith('/api/health') ||
|
|
path.startsWith('/api/monitor') ||
|
|
path.startsWith('/api/library/backup-ingest') ||
|
|
path.startsWith('/_nuxt') ||
|
|
path.startsWith('/favicon') ||
|
|
path === '/login'
|
|
) {
|
|
return
|
|
}
|
|
const user = getSessionUser(event)
|
|
if (user) return
|
|
if (path.startsWith('/api/')) {
|
|
throw createError({ statusCode: 401, statusMessage: 'Authentication required' })
|
|
}
|
|
return sendRedirect(event, '/login', 302)
|
|
})
|