From 15916047fa3b2339ae46de5f1f561c2aa0c0cb96 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Tue, 2 Dec 2025 18:25:58 +0000
Subject: [PATCH] Remove backend access control, now that the profile and admin
 apps handle that via API.

---
 passkey/fastapi/admin.py   | 17 +----------------
 passkey/fastapi/mainapp.py | 34 +++++++++++-----------------------
 2 files changed, 12 insertions(+), 39 deletions(-)

diff --git a/passkey/fastapi/admin.py b/passkey/fastapi/admin.py
index efee19c..9b8edcb 100644
--- a/passkey/fastapi/admin.py
+++ b/passkey/fastapi/admin.py
@@ -36,22 +36,7 @@ async def general_exception_handler(_request, exc: Exception):
 
 @app.get("/")
 async def adminapp(request: Request, auth=AUTH_COOKIE):
-    """Serve admin SPA only for authenticated users with admin/org permissions.
-
-    On missing/invalid session or insufficient permissions, serve restricted SPA.
-    """
-    try:
-        await authz.verify(
-            auth,
-            ["auth:admin", "auth:org:*"],
-            match=permutil.has_any,
-            host=request.headers.get("host"),
-        )
-        return FileResponse(frontend.file("admin/index.html"))
-    except HTTPException as e:
-        return FileResponse(
-            frontend.file("restricted", "index.html"), status_code=e.status_code
-        )
+    return FileResponse(frontend.file("admin/index.html"))
 
 
 # -------------------- Organizations --------------------
diff --git a/passkey/fastapi/mainapp.py b/passkey/fastapi/mainapp.py
index 910bd7d..bb03c4e 100644
--- a/passkey/fastapi/mainapp.py
+++ b/passkey/fastapi/mainapp.py
@@ -65,29 +65,17 @@ app.mount(
 @app.get("/")
 @app.get("/auth/")
 async def frontapp(request: Request, response: Response, auth=AUTH_COOKIE):
-    """Serve the user profile SPA only for authenticated sessions; otherwise restricted SPA.
+    """Serve the user profile app.
 
-    Login / authentication UX is centralized in the restricted app.
+    Access control is handled via APIs.
     """
-    if not auth:
-        return FileResponse(frontend.file("restricted", "index.html"), status_code=401)
-    from ..authsession import get_session  # local import
-
-    try:
-        await get_session(auth, host=request.headers.get("host"))
-        cfg_host = hostutil.configured_auth_host()
-        if cfg_host:
-            cur_host = hostutil.normalize_host(request.headers.get("host"))
-            cfg_normalized = hostutil.normalize_host(cfg_host)
-            if cur_host and cfg_normalized and cur_host != cfg_normalized:
-                return FileResponse(frontend.file("host", "index.html"))
-        return FileResponse(frontend.file("index.html"))
-    except Exception:
-        if auth:
-            from . import session as session_mod
-
-            session_mod.clear_session_cookie(response)
-        return FileResponse(frontend.file("restricted", "index.html"), status_code=401)
+    cfg_host = hostutil.configured_auth_host()
+    if cfg_host:
+        cur_host = hostutil.normalize_host(request.headers.get("host"))
+        cfg_normalized = hostutil.normalize_host(cfg_host)
+        if cur_host and cfg_normalized and cur_host != cfg_normalized:
+            return FileResponse(frontend.file("host", "index.html"))
+    return FileResponse(frontend.file("index.html"))
 
 
 @app.get("/admin", include_in_schema=False)
@@ -98,7 +86,7 @@ async def admin_root_redirect():
 
 @app.get("/admin/", include_in_schema=False)
 async def admin_root(request: Request, auth=AUTH_COOKIE):
-    return await admin.adminapp(request, auth)  # Delegated (enforces access control)
+    return await admin.adminapp(request, auth)  # Delegated to admin app
 
 
 @app.get("/auth/restricted")
@@ -115,7 +103,7 @@ async def restricted_api_view():
 @app.get("/{reset}")
 @app.get("/auth/{reset}")
 async def reset_link(reset: str):
-    """Serve the SPA directly with an injected reset token."""
+    """Serve the reset app directly with an injected reset token."""
     if not passphrase.is_well_formed(reset):
         raise HTTPException(status_code=404)
     return FileResponse(frontend.file("reset", "index.html"))