From a00327abe9e8bf703bb0ae31608a0f836fe6498a Mon Sep 17 00:00:00 2001
From: jaberjaber23 <jaberib647@gmail.com>
Date: Mon, 9 Mar 2026 03:19:14 +0300
Subject: [PATCH] fix auth

---
 Cargo.lock                            | 28 +++++++++++++--------------
 crates/openfang-api/src/middleware.rs | 22 ++++-----------------
 2 files changed, 18 insertions(+), 32 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 54bf9a9a..18929b74 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3875,7 +3875,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-api"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "async-trait",
  "axum",
@@ -3912,7 +3912,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-channels"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "async-trait",
  "axum",
@@ -3944,7 +3944,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-cli"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "clap",
  "clap_complete",
@@ -3971,7 +3971,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-desktop"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "axum",
  "open",
@@ -3997,7 +3997,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-extensions"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "aes-gcm",
  "argon2",
@@ -4025,7 +4025,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-hands"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "chrono",
  "dashmap",
@@ -4042,7 +4042,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-kernel"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "async-trait",
  "chrono",
@@ -4078,7 +4078,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-memory"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "async-trait",
  "chrono",
@@ -4097,7 +4097,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-migrate"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "chrono",
  "dirs 6.0.0",
@@ -4116,7 +4116,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-runtime"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -4150,7 +4150,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-skills"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "chrono",
  "hex",
@@ -4173,7 +4173,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-types"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "async-trait",
  "chrono",
@@ -4192,7 +4192,7 @@ dependencies = [
 
 [[package]]
 name = "openfang-wire"
-version = "0.3.32"
+version = "0.3.33"
 dependencies = [
  "async-trait",
  "chrono",
@@ -8821,7 +8821,7 @@ checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
 
 [[package]]
 name = "xtask"
-version = "0.3.32"
+version = "0.3.33"
 
 [[package]]
 name = "yoke"
diff --git a/crates/openfang-api/src/middleware.rs b/crates/openfang-api/src/middleware.rs
index 2d3ea729..6cac9464 100644
--- a/crates/openfang-api/src/middleware.rs
+++ b/crates/openfang-api/src/middleware.rs
@@ -119,25 +119,11 @@ pub async fn auth(
         return next.run(request).await;
     }
 
-    // SECURITY: If no API key configured, allow localhost access but reject remote.
-    // Many users skip the wizard or create config.toml manually without setting api_key.
-    // Blocking localhost access makes the dashboard unusable for them.
+    // If no API key configured, skip auth entirely.
+    // Users who don't set api_key accept that all endpoints are open.
+    // To secure the dashboard, set api_key in config.toml.
     if api_key.is_empty() {
-        let is_loopback = request
-            .extensions()
-            .get::<axum::extract::ConnectInfo<std::net::SocketAddr>>()
-            .map(|ci| ci.0.ip().is_loopback())
-            .unwrap_or(false);
-        if is_loopback {
-            return next.run(request).await;
-        }
-        return Response::builder()
-            .status(StatusCode::UNAUTHORIZED)
-            .header("www-authenticate", "Bearer")
-            .body(Body::from(
-                serde_json::json!({"error": "No API key configured. Set api_key in config.toml or pass --api-key on startup."}).to_string(),
-            ))
-            .unwrap_or_default();
+        return next.run(request).await;
     }
 
     // Check Authorization: Bearer <token> header, then fallback to X-API-Key