Removes the deploy hard-fail on CRYPTO_API_TOKEN; the app works with no token at all. When set, it still protects /api and /api/ws (nginx injects it server-side). Adds tests for the tokenless API and WebSocket.
Removes the deploy hard-fail on `CRYPTO_API_TOKEN`; the app works with no token at all. When set, it still protects `/api` and `/api/ws` (nginx injects it server-side). Adds tests for the tokenless API and WebSocket.
Backend: 81 tests pass, ruff clean. Frontend: build + tests pass.
The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.
matitos
merged commit d80e7b155e into main2026-09-19 16:35:37 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Removes the deploy hard-fail on
CRYPTO_API_TOKEN; the app works with no token at all. When set, it still protects/apiand/api/ws(nginx injects it server-side). Adds tests for the tokenless API and WebSocket.Backend: 81 tests pass, ruff clean. Frontend: build + tests pass.