Remove AUTH_REQUIRED env variable from the application

[frankbria]

AUTH_REQUIRED=false was an acceptable environment variable while creating authentication in order to run tests. Now that authentication is up and running in FastAPI, the variable is no longer needed and poses a security risk. It should be completely removed from the application and all modules that require it should be fixed to run without it.

[traycerai]

Plan

Observations

The AUTH_REQUIRED environment variable is currently used throughout the codebase as a temporary flag to bypass authentication during development and testing. It's referenced in 4 core application files (file:codeframe/ui/auth.py, file:codeframe/ui/server.py, file:codeframe/ui/routers/websocket.py, file:codeframe/persistence/schema_manager.py), multiple test configuration files, documentation files, and E2E tests. The authentication system is now fully functional with BetterAuth integration, making this bypass mechanism a security risk that needs to be removed.

Approach

The plan removes AUTH_REQUIRED completely by making authentication mandatory across the application. Tests will be updated to use proper authentication with test fixtures that create valid sessions instead of bypassing auth. The WebSocket authentication will be simplified to always require tokens, and the schema manager will no longer create default admin users. Documentation will be updated to reflect that authentication is now always required, and environment variable examples will have AUTH_REQUIRED removed.

Implementation Steps

1. Update Core Authentication Module

File: file:codeframe/ui/auth.py

Remove the AUTH_REQUIRED check and default admin user fallback from the get_current_user function (lines 92-98). The function should always require valid credentials and raise HTTPException with 401 status when credentials are missing or invalid. Remove the conditional logic that returns User(id=1, email="admin@localhost", name="Admin User") when auth is not required.

2. Update Server Startup Validation

File: file:codeframe/ui/server.py

Remove the _validate_auth_config function entirely (lines 81-110) as authentication will always be required. Remove the call to _validate_auth_config() from the lifespan function (line 179). This eliminates the startup check that was preventing deployment with AUTH_REQUIRED=false in hosted mode.

3. Update WebSocket Authentication

File: file:codeframe/ui/routers/websocket.py

Remove all AUTH_REQUIRED checks from the WebSocket endpoint (lines 91, 97, 135-137, 197). Simplify the authentication logic to always require a valid token from query parameters. Remove the fallback that sets user_id = 1 when AUTH_REQUIRED=false. Remove the conditional authorization check (line 197) and always verify user has project access when a project_id is provided.

4. Update Schema Manager

File: file:codeframe/persistence/schema_manager.py

Remove the AUTH_REQUIRED check from _ensure_default_admin_user method (lines 750-756). Remove the entire conditional logic that skips admin user creation in production. Since tests will now use proper authentication, the default admin user creation can be removed entirely, or kept only for initial database setup without the AUTH_REQUIRED check.

5. Update Test Fixtures - API Tests

File: file:tests/api/conftest.py

Remove AUTH_REQUIRED from the environment variables list (line 61) and remove the line that sets it to "false" (line 79). Update the fixture to create a valid test session token for the admin user instead of relying on the auth bypass. Add code to create a session token in the database:

# Create a test session token
import secrets
from datetime import datetime, timedelta, timezone

token = secrets.token_urlsafe(32)
expires_at = (datetime.now(timezone.utc) + timedelta(days=1)).isoformat()
cursor.execute(
    "INSERT INTO sessions (id, token, user_id, expires_at) VALUES (?, ?, ?, ?)",
    (f"test-session-{token[:8]}", token, 1, expires_at)
)
db.conn.commit()

# Store token for test client to use
client.headers["Authorization"] = f"Bearer {token}"

Update the comment on line 92 to reflect that tests now use proper authentication.

6. Update Test Fixtures - UI/WebSocket Tests

File: file:tests/ui/conftest.py

Remove the line that sets AUTH_REQUIRED to "false" (line 126). Update the fixture to create a valid test session token similar to the API tests. The token should be passed to WebSocket connections via query parameters: ws://localhost:8080/ws?token={token}.

7. Update Authentication Tests

File: file:tests/auth/test_authentication.py

Remove or update tests that specifically test AUTH_REQUIRED=false behavior (lines 140, 148, 152-155). The test test_auth_not_required_returns_default_user should be removed entirely as this behavior will no longer exist. Update test_missing_token_raises_401 to remove the monkeypatch line (line 140) since auth will always be required.

8. Update Authorization Integration Tests

File: file:tests/auth/test_authorization_integration.py

Update the test test_get_project_no_token_unauthorized (lines 119-124) to expect 401 status consistently, removing the comment about AUTH_REQUIRED behavior and the assertion that allows 200 status.

9. Update E2E Tests

File: file:tests/e2e/test_auth_flow.spec.ts

Remove all AUTH_REQUIRED checks from the TypeScript tests (lines 183-189, 259-265). Update tests to always expect authentication to be required and redirects to login page to always occur when accessing protected routes without valid tokens.

File: file:tests/e2e/seed-test-data.py

Remove the comment about AUTH_REQUIRED=false on line 74.

10. Update Documentation

File: file:README.md

Remove the section about AUTH_REQUIRED environment variable (lines 148-150, 245). Update the authentication section to state that authentication is always required.

File: file:CONTRIBUTING.md

Remove the line that exports AUTH_REQUIRED (line 28). Remove the entire "Working with Authentication" section that describes Development Mode vs Production Mode (lines 38-74).

File: file:SECURITY.md

Remove the sections showing AUTH_REQUIRED=false and AUTH_REQUIRED=true examples (lines 33-47).

File: file:docs/authentication.md

Remove the "Enabling Authentication" section (lines 422-434) and the "Migration Steps" section (lines 437-467). Remove the "Backward Compatibility" section (lines 473-481). Update troubleshooting section to remove references to AUTH_REQUIRED (line 655).

11. Update Environment Examples

File: file:.env.example

Verify that AUTH_REQUIRED is not present in the example file (it's already not there based on the current content).

File: file:.env.staging.example

Verify that AUTH_REQUIRED is not present in the staging example file (it's already not there based on the current content).

12. Update Root Test Configuration

File: file:tests/conftest.py

No changes needed as this file doesn't reference AUTH_REQUIRED.

Testing Verification

After implementing these changes, verify:

1. All API endpoints require valid authentication tokens
2. WebSocket connections require valid tokens in query parameters
3. All tests pass with proper authentication using test session tokens
4. No default admin user bypass exists in the codebase
5. Server starts without AUTH_REQUIRED environment variable
6. Documentation no longer references AUTH_REQUIRED

Security Impact

This change eliminates a significant security risk by removing the ability to bypass authentication. All requests will now require valid session tokens obtained through proper authentication flows. This ensures that the application cannot be accidentally deployed in an insecure state.

Import In IDE

🤖 Prompt for AI Agents

## Observations

The AUTH_REQUIRED environment variable is currently used throughout the codebase as a temporary flag to bypass authentication during development and testing. It's referenced in 4 core application files (`file:codeframe/ui/auth.py`, `file:codeframe/ui/server.py`, `file:codeframe/ui/routers/websocket.py`, `file:codeframe/persistence/schema_manager.py`), multiple test configuration files, documentation files, and E2E tests. The authentication system is now fully functional with BetterAuth integration, making this bypass mechanism a security risk that needs to be removed.

## Approach

The plan removes AUTH_REQUIRED completely by making authentication mandatory across the application. Tests will be updated to use proper authentication with test fixtures that create valid sessions instead of bypassing auth. The WebSocket authentication will be simplified to always require tokens, and the schema manager will no longer create default admin users. Documentation will be updated to reflect that authentication is now always required, and environment variable examples will have AUTH_REQUIRED removed.

## Implementation Steps

### 1. Update Core Authentication Module

**File: `file:codeframe/ui/auth.py`**

Remove the AUTH_REQUIRED check and default admin user fallback from the `get_current_user` function (lines 92-98). The function should always require valid credentials and raise `HTTPException` with 401 status when credentials are missing or invalid. Remove the conditional logic that returns `User(id=1, email="admin@localhost", name="Admin User")` when auth is not required.

### 2. Update Server Startup Validation

**File: `file:codeframe/ui/server.py`**

Remove the `_validate_auth_config` function entirely (lines 81-110) as authentication will always be required. Remove the call to `_validate_auth_config()` from the `lifespan` function (line 179). This eliminates the startup check that was preventing deployment with AUTH_REQUIRED=false in hosted mode.

### 3. Update WebSocket Authentication

**File: `file:codeframe/ui/routers/websocket.py`**

Remove all AUTH_REQUIRED checks from the WebSocket endpoint (lines 91, 97, 135-137, 197). Simplify the authentication logic to always require a valid token from query parameters. Remove the fallback that sets `user_id = 1` when AUTH_REQUIRED=false. Remove the conditional authorization check (line 197) and always verify user has project access when a project_id is provided.

### 4. Update Schema Manager

**File: `file:codeframe/persistence/schema_manager.py`**

Remove the AUTH_REQUIRED check from `_ensure_default_admin_user` method (lines 750-756). Remove the entire conditional logic that skips admin user creation in production. Since tests will now use proper authentication, the default admin user creation can be removed entirely, or kept only for initial database setup without the AUTH_REQUIRED check.

### 5. Update Test Fixtures - API Tests

**File: `file:tests/api/conftest.py`**

Remove AUTH_REQUIRED from the environment variables list (line 61) and remove the line that sets it to "false" (line 79). Update the fixture to create a valid test session token for the admin user instead of relying on the auth bypass. Add code to create a session token in the database:

```python
# Create a test session token
import secrets
from datetime import datetime, timedelta, timezone

token = secrets.token_urlsafe(32)
expires_at = (datetime.now(timezone.utc) + timedelta(days=1)).isoformat()
cursor.execute(
    "INSERT INTO sessions (id, token, user_id, expires_at) VALUES (?, ?, ?, ?)",
    (f"test-session-{token[:8]}", token, 1, expires_at)
)
db.conn.commit()

# Store token for test client to use
client.headers["Authorization"] = f"Bearer {token}"
```

Update the comment on line 92 to reflect that tests now use proper authentication.

### 6. Update Test Fixtures - UI/WebSocket Tests

**File: `file:tests/ui/conftest.py`**

Remove the line that sets AUTH_REQUIRED to "false" (line 126). Update the fixture to create a valid test session token similar to the API tests. The token should be passed to WebSocket connections via query parameters: `ws://localhost:8080/ws?token={token}`.

### 7. Update Authentication Tests

**File: `file:tests/auth/test_authentication.py`**

Remove or update tests that specifically test AUTH_REQUIRED=false behavior (lines 140, 148, 152-155). The test `test_auth_not_required_returns_default_user` should be removed entirely as this behavior will no longer exist. Update `test_missing_token_raises_401` to remove the monkeypatch line (line 140) since auth will always be required.

### 8. Update Authorization Integration Tests

**File: `file:tests/auth/test_authorization_integration.py`**

Update the test `test_get_project_no_token_unauthorized` (lines 119-124) to expect 401 status consistently, removing the comment about AUTH_REQUIRED behavior and the assertion that allows 200 status.

### 9. Update E2E Tests

**File: `file:tests/e2e/test_auth_flow.spec.ts`**

Remove all AUTH_REQUIRED checks from the TypeScript tests (lines 183-189, 259-265). Update tests to always expect authentication to be required and redirects to login page to always occur when accessing protected routes without valid tokens.

**File: `file:tests/e2e/seed-test-data.py`**

Remove the comment about AUTH_REQUIRED=false on line 74.

### 10. Update Documentation

**File: `file:README.md`**

Remove the section about AUTH_REQUIRED environment variable (lines 148-150, 245). Update the authentication section to state that authentication is always required.

**File: `file:CONTRIBUTING.md`**

Remove the line that exports AUTH_REQUIRED (line 28). Remove the entire "Working with Authentication" section that describes Development Mode vs Production Mode (lines 38-74).

**File: `file:SECURITY.md`**

Remove the sections showing AUTH_REQUIRED=false and AUTH_REQUIRED=true examples (lines 33-47).

**File: `file:docs/authentication.md`**

Remove the "Enabling Authentication" section (lines 422-434) and the "Migration Steps" section (lines 437-467). Remove the "Backward Compatibility" section (lines 473-481). Update troubleshooting section to remove references to AUTH_REQUIRED (line 655).

### 11. Update Environment Examples

**File: `file:.env.example`**

Verify that AUTH_REQUIRED is not present in the example file (it's already not there based on the current content).

**File: `file:.env.staging.example`**

Verify that AUTH_REQUIRED is not present in the staging example file (it's already not there based on the current content).

### 12. Update Root Test Configuration

**File: `file:tests/conftest.py`**

No changes needed as this file doesn't reference AUTH_REQUIRED.

## Testing Verification

After implementing these changes, verify:

1. All API endpoints require valid authentication tokens
2. WebSocket connections require valid tokens in query parameters
3. All tests pass with proper authentication using test session tokens
4. No default admin user bypass exists in the codebase
5. Server starts without AUTH_REQUIRED environment variable
6. Documentation no longer references AUTH_REQUIRED

## Security Impact

This change eliminates a significant security risk by removing the ability to bypass authentication. All requests will now require valid session tokens obtained through proper authentication flows. This ensures that the application cannot be accidentally deployed in an insecure state.

---

Execution Information

Branch: main
Commit: 0c96591

---

💡 Tips

Supported Commands (Inside Comments)

• Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

• Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
• Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.