Authorization mode leaves generation, indexing, chat, and cache reads unprotected #604

Affected versions: confirmed on main at commit d92819a (the project publishes no tagged release).

Summary

WIKI_AUTH_MODE's shared authorization code is checked by the frontend's gate screen and by DELETE /api/wiki_cache, but the backend never creates an authenticated session and does not enforce the code on any other route. Wiki generation, repo indexing, chat, codemap, and cache-read endpoints all perform zero authorization check regardless of WIKI_AUTH_MODE.

Details

# api/routers/auth.py
@router.post("/validate")
async def validate_auth_code(request: AuthorizationConfig):
    return {"success": WIKI_AUTH_CODE == request.code}   # no session created

# api/routers/wiki.py
@router.post("/wiki/tasks", response_model=WikiTaskSubmitResult)
async def submit_wiki_task(request: WikiTaskRequest):
    return await registry.submit(...)   # no auth check at all

# api/routers/repo.py
@router.post("/prepare")
async def prepare_repo_index(request: RepoPrepareRequest):
    ...
    task = asyncio.create_task(prepare_index(request))   # no auth check at all

A full grep of api/ confirms WIKI_AUTH_CODE/WIKI_AUTH_MODE are referenced nowhere else in the router layer except the one DELETE /api/wiki_cache check.

POC

(available upon request)

Impact

An operator who enables WIKI_AUTH_MODE specifically to gate access to a deployment gets no actual protection on any route except cache deletion: anyone who bypasses the frontend gate screen (trivial, since it's enforced client-side) can trigger generation/indexing (provider-funded compute cost) and read chat/cache content.

Suggested fix: create a backend authentication dependency and apply it consistently to every protected route. A fix is included in the linked PR.

Fix: #595