[nmgaston]

PR Checklist

• Unit Tests have been added for new changes
• API tests have been updated if applicable
• All commented code has been removed
• If you've added a dependency, you've ensured license is compatible with Apache 2.0 and clearly outlined the added dependency.

What are you changing?

• Detect Console’s authDisabled feature during startup before protected routes are evaluated. Only an explicit true disables UI authentication; missing values, request errors, or timeouts retain the login requirement. Cloud behavior remains unchanged.
• When Console authentication is disabled, allow access to the app without creating a user session, skip OAuth startup, and hide login/logout actions.
• Load version information when app access is allowed, including anonymous access.
• Add tests for the feature response, backward compatibility with older Console responses, auth-state behavior, and login/footer UI.

Anything the reviewer should know when reviewing this PR?

If the there are associated PRs in other repositories, please link them here (i.e. device-management-toolkit/repo#365 )

device-management-toolkit/console#1322

[Copilot]

🟡 Changes recommended

The capability request can stall startup indefinitely, and sessionless Console access skips version loading and update notifications.

2 open findings

• Add timeout to prevent Console request from blocking Angular bootstrap · New
• Load Console version when protected routes are accessible without a session · New

What changed in this PR

Adds Console authentication-disabled support while preserving cloud login behavior.

Changes:

• Reads the server authentication flag before initializing OAuth.
• Allows sessionless app access and hides login/logout controls when authentication is disabled.
• Updates component and service tests.

File	Description
src/​models/​models.ts	Adds optional authentication capability flag.
src/​main.ts	Loads capabilities before OAuth initialization.
src/​app/​login/​login.component.ts	Guards login actions and redirects sessionless access.
src/​app/​login/​login.component.spec.ts	Tests hidden login controls.
src/​app/​login/​login.component.html	Conditionally hides login controls.
src/​app/​core/​nav-footer/​nav-footer.component.ts	Guards logout action.
src/​app/​core/​nav-footer/​nav-footer.component.spec.ts	Tests disabled logout behavior.
src/​app/​core/​nav-footer/​nav-footer.component.html	Hides account and logout controls.
src/​app/​auth.service.ts	Adds authentication-disabled access state.
src/​app/​auth.service.spec.ts	Tests protected-route access decisions.
src/​app/​app.component.ts	Drives shell visibility from app access.
src/​app/​app.component.spec.ts	Updates shell access tests.
src/​app/​app.component.html	Shows navigation for permitted access.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Authentication bypass and OAuth startup changes require runtime validation across cloud and Console deployments before approval.

0 open findings

2 resolved since last review

• Add timeout to prevent Console request from blocking Angular bootstrap
• Load Console version when protected routes are accessible without a session

🧠 Review effort: Balanced

[nmgaston]

🔵 Needs a closer look

Authentication bypass and OAuth startup changes require runtime validation across cloud and Console deployments before approval.

0 open findings

2 resolved since last review

• Add timeout to prevent Console request from blocking Angular bootstrap
• Load Console version when protected routes are accessible without a session

🧠 Review effort: Balanced

Tested these scenarios:

1. Cloud: login is still required; the Console auth-disabled setting has no effect.
2. Console with auth enabled: password login still works. If OAuth is enabled, its discovery and login flow still starts and completes.
3. Console with auth disabled: the UI reaches the app without a session; login and logout controls are absent; Console version information loads.
4. Older Console or unavailable feature endpoint: missing authDisabled, request failure, or timeout keeps authentication required.

[rsdmike]

Thanks for this. I'm closing it in favor of #3577, which avoids the startup request by having Console set the flag in the bundle, but I'm adopting your approach of keeping "logged in" separate from "allowed in" through canActivateProtectedRoutes$, and of loading the version info whenever access is allowed.