@threadbase-sh/streamer 1.53.0 → 1.53.1

package/dist/index.cjs

@@ -4171,21 +4171,16 @@ var authMiddleware = (deps) => async (c, next) => {
     await next();
     return;
   }
-  if (deps.localNoAuth) {
-    if (isLocalRequest(remoteAddr)) {
-      await next();
-      return;
-    }
-  }
+  const loopbackOwner = deps.localNoAuth && isLocalRequest(remoteAddr);
   const authorization = c.req.header("authorization");
   const bearer = authorization?.startsWith("Bearer ") ? authorization.slice(7) : void 0;
   const queryKey = c.req.query("key") ?? void 0;
   const presented = bearer ?? queryKey;
-  if (!presented) {
+  if (!presented && !loopbackOwner) {
     return c.json({ error: "Unauthorized" }, 401);
   }
   let principal = null;
-  const device = deps.devicesRepo()?.authenticate(presented) ?? null;
+  const device = presented ? deps.devicesRepo()?.authenticate(presented) ?? null : null;
   if (device) {
     principal = {
       kind: "device",
@@ -4196,7 +4191,9 @@ var authMiddleware = (deps) => async (c, next) => {
       deps.devicesRepo()?.touch(device.device_id);
     } catch {
     }
-  } else if (validateApiKey(presented, deps.apiKey)) {
+  } else if (presented && validateApiKey(presented, deps.apiKey)) {
+    principal = legacyPrincipal();
+  } else if (loopbackOwner) {
     principal = legacyPrincipal();
   }
   if (!principal) {