From e61efd141c15efa2bfecc6e6cac4e5ccf09c6822 Mon Sep 17 00:00:00 2001 From: Brian Krabach Date: Mon, 30 Mar 2026 20:54:21 -0700 Subject: [PATCH] feat: exempt /api/instance-info from auth --- muxplex/auth.py | 2 +- muxplex/tests/test_auth.py | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/muxplex/auth.py b/muxplex/auth.py index a7535e5..2afdb39 100644 --- a/muxplex/auth.py +++ b/muxplex/auth.py @@ -134,7 +134,7 @@ def authenticate_pam(username: str, password: str) -> bool: # --------------------------------------------------------------------------- # Paths that bypass auth (login page itself, static assets it needs) -_AUTH_EXEMPT_PATHS = {"/login", "/auth/mode", "/auth/logout"} +_AUTH_EXEMPT_PATHS = {"/login", "/auth/mode", "/auth/logout", "/api/instance-info"} # Socket-level localhost addresses — cannot be forged via HTTP headers _LOCALHOST_ADDRS = {"127.0.0.1", "::1"} diff --git a/muxplex/tests/test_auth.py b/muxplex/tests/test_auth.py index 235979c..2a9f591 100644 --- a/muxplex/tests/test_auth.py +++ b/muxplex/tests/test_auth.py @@ -447,3 +447,16 @@ def test_resolve_auth_generates_password_as_last_resort(monkeypatch, capsys, tmp assert len(pw) > 10 assert "generated" in captured.err assert pw in captured.err + + +def test_middleware_instance_info_path_excluded(): + """/api/instance-info is excluded from auth (public metadata endpoint).""" + app = _make_test_app() + + @app.get("/api/instance-info") + async def instance_info(): + return PlainTextResponse("info") + + client = TestClient(app, base_url="http://192.168.1.1") + response = client.get("/api/instance-info") + assert response.status_code == 200