thevoidforge 21.0.8 → 21.0.9

package/dist/wizard/api/auth.js

@@ -4,7 +4,7 @@
  */
 import { addRoute } from '../router.js';
 import { parseJsonBody } from '../lib/body-parser.js';
-import { hasUsers, createUser, login, logout, validateSession, parseSessionCookie, buildSessionCookie, clearSessionCookie, isRemoteMode, checkRateLimit, getClientIp, getUserRole, isValidUsername, } from '../lib/tower-auth.js';
+import { hasUsers, createUser, login, logout, validateSession, parseSessionCookie, buildSessionCookie, clearSessionCookie, isRemoteMode, isLanMode, checkRateLimit, getClientIp, getUserRole, isValidUsername, } from '../lib/tower-auth.js';
 import { audit } from '../lib/audit-log.js';
 import { sendJson } from '../lib/http-helpers.js';
 // POST /api/auth/setup — Create initial admin user (only when no users exist)
@@ -114,8 +114,8 @@ addRoute('POST', '/api/auth/logout', async (req, res) => {
 });
 // GET /api/auth/session — Check if current session is valid
 addRoute('GET', '/api/auth/session', async (req, res) => {
-    if (!isRemoteMode()) {
-        sendJson(res, 200, { success: true, data: { authenticated: true, username: 'local', role: 'admin', remoteMode: false } });
+    if (!isRemoteMode() && !isLanMode()) {
+        sendJson(res, 200, { success: true, data: { authenticated: true, username: 'local', role: 'admin', remoteMode: false, lanMode: false } });
         return;
     }
     const token = parseSessionCookie(req.headers.cookie);
@@ -129,5 +129,5 @@ addRoute('GET', '/api/auth/session', async (req, res) => {
         sendJson(res, 200, { success: true, data: { authenticated: false, needsSetup: false } });
         return;
     }
-    sendJson(res, 200, { success: true, data: { authenticated: true, username: session.username, role: session.role, remoteMode: true } });
+    sendJson(res, 200, { success: true, data: { authenticated: true, username: session.username, role: session.role, remoteMode: isRemoteMode(), lanMode: isLanMode() } });
 });

package/dist/wizard/server.js

@@ -159,11 +159,10 @@ async function handleRequest(req, res) {
         sendJson(res, 403, { success: false, error: 'Missing X-VoidForge-Request header' });
         return;
     }
-    // LAN mode — full access. LAN is a private network (ZeroTier, local subnet),
-    // inherently more secure than remote. No endpoint restrictions.
-    // Auth: optional password (no TOTP). All features available.
-    // Auth middleware — in remote mode, require valid session for non-exempt paths
-    if (isRemoteMode()) {
+    // Auth middleware — in remote and LAN modes, require valid session for non-exempt paths.
+    // LAN mode has full access (same as remote) but simpler auth (password only, no TOTP).
+    // Local mode (127.0.0.1) has no auth — it's your own machine.
+    if (isRemoteMode() || isLanMode()) {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (!isAuthExempt(url.pathname)) {
             const token = parseSessionCookie(req.headers.cookie);

package/dist/wizard/ui/lobby.js

@@ -710,14 +710,14 @@
       const res = await fetch('/api/auth/session');
       const body = await res.json();
       const data = body.data || {};
-      if (data.remoteMode && data.authenticated) {
+      if ((data.remoteMode || data.lanMode) && data.authenticated) {
         currentUser = { username: data.username || '', role: data.role || 'viewer' };
         const roleLabel = { admin: 'Admin', deployer: 'Deployer', viewer: 'Viewer' }[data.role] || '';
         authUser.textContent = data.username + (roleLabel ? ' (' + roleLabel + ')' : '');
         authUser.style.display = '';
         btnLogout.style.display = '';
       }
-      if (data.remoteMode && !data.authenticated) {
+      if ((data.remoteMode || data.lanMode) && !data.authenticated) {
         window.location.href = '/login.html';
       }
     } catch { /* local mode — no auth needed */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thevoidforge",
-  "version": "21.0.8",
+  "version": "21.0.9",
   "description": "From nothing, everything. A methodology framework for building with Claude Code.",
   "type": "module",
   "engines": {