Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

backend/app/services/runtime_service.py

@@ -28,42 +28,6 @@ from .secret_store import secret_storage_status
 from .setup_service import get_setup_status, list_connector_settings
 
 _BACKUP_LOCK = threading.Lock()
-_OPERATOR_AUTH_SETTING_KEY = "security.operator_auth"
-
-
-def apply_stored_operator_auth_setting(session: Session) -> None:
-    stored = session.get(AppSetting, _OPERATOR_AUTH_SETTING_KEY)
-    if stored and isinstance(stored.value_json, dict) and isinstance(stored.value_json.get("required"), bool):
-        settings.operator_auth_required = stored.value_json["required"]
-
-
-def operator_auth_policy() -> dict[str, bool]:
-    return {"required": settings.operator_auth_required}
-
-
-def update_operator_auth_policy(session: Session, required: bool) -> dict[str, bool]:
-    stored = session.get(AppSetting, _OPERATOR_AUTH_SETTING_KEY)
-    if stored is None:
-        stored = AppSetting(key=_OPERATOR_AUTH_SETTING_KEY, is_secret=False)
-    stored.value_json = {"required": required}
-    stored.updated_at = datetime.now(timezone.utc)
-    session.add(stored)
-    settings.operator_auth_required = required
-    log_event(
-        session,
-        source="manual",
-        identity="operator",
-        action_id="security.operator_auth.update",
-        target="operator_session",
-        target_type="security_setting",
-        risk="medium",
-        policy_decision="allowed",
-        reason="Operator session requirement changed from Settings.",
-        result="success",
-        redacted_metadata={"required": required},
-    )
-    session.commit()
-    return operator_auth_policy()
 
 
 def _data_dir() -> Path:
@@ -104,17 +68,12 @@ def frontend_assets_available() -> bool:
 def production_warnings() -> list[str]:
     warnings: list[str] = []
     if settings.environment == "production":
-        proxy_operator_ready = bool(
-            settings.operator_proxy_auth_enabled
-            and settings.operator_proxy_trusted_networks
-            and (settings.operator_proxy_users or settings.operator_proxy_groups)
-        )
-        if not settings.operator_auth_required:
-            warnings.append("APPOPS_REQUIRE_OPERATOR_AUTH is disabled; private LAN operator routes are unlocked.")
-        elif not proxy_operator_ready and (not settings.operator_token or settings.operator_token in {"change-me", "changeme", "dev", "test"}):
-            warnings.append("APPOPS_OPERATOR_TOKEN is missing or unsafe; protected operator routes fail closed.")
-        if settings.operator_proxy_auth_enabled and not proxy_operator_ready:
-            warnings.append("Account-bound operator auth is enabled but trusted proxy networks and an allowed user or group are not fully configured.")
+        from .oidc_login import provider_status
+        proxy_ready = bool(settings.operator_proxy_auth_enabled and settings.operator_proxy_trusted_networks)
+        if not proxy_ready and not any(provider["configured"] for provider in provider_status()):
+            warnings.append("No user identity provider is configured; human API access fails closed. Configure Authentik or Microsoft Entra.")
+        if not settings.auth_admin_subjects and not settings.auth_admin_emails:
+            warnings.append("No initial administrator is configured. Set APPOPS_AUTH_ADMIN_SUBJECTS or a verified Authentik bootstrap email.")
         if not settings.voice_token or settings.voice_token in {"change-me", "changeme", "dev", "test"}:
             warnings.append("APP_OPS_VOICE_TOKEN is missing or unsafe for production.")
         warnings.extend(secret_storage_status()["warnings"])