From 3f2a7b81cf4ce118ea67f01d7317eb99d989261f Mon Sep 17 00:00:00 2001 From: cclohmar Date: Sun, 14 Jun 2026 14:54:50 +0000 Subject: [PATCH] fix(auth): Admin UI pages use OIDC session auth, API stays bearer token --- src/main.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/main.go b/src/main.go index ad0b181..6cc9890 100644 --- a/src/main.go +++ b/src/main.go @@ -122,11 +122,13 @@ func main() { } uiHandler.RegisterRoutes(mux, combinedAuth) - // --- Admin routes (protected by bearer token) --- + // --- Admin API routes (JSON, protected by bearer token) --- adminAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken) adminHandler.RegisterRoutes(mux, adminAuth) - adminHandler.RegisterUIRoutes(mux, adminAuth) - adminHandler.RegisterHTMXRoutes(mux, adminAuth) + + // --- Admin UI routes (Templ-rendered HTML, protected by OIDC session) --- + adminHandler.RegisterUIRoutes(mux, combinedAuth) + adminHandler.RegisterHTMXRoutes(mux, combinedAuth) // --- OIDC config page — shows Authelia status --- mux.HandleFunc("GET /auth/status", func(w http.ResponseWriter, r *http.Request) {