Remove backend access control, now that the profile and admin apps handle that via API.

passkey/fastapi/admin.py

@@ -36,22 +36,7 @@ async def general_exception_handler(_request, exc: Exception):
 
 @app.get("/")
 async def adminapp(request: Request, auth=AUTH_COOKIE):
-    """Serve admin SPA only for authenticated users with admin/org permissions.
-
-    On missing/invalid session or insufficient permissions, serve restricted SPA.
-    """
-    try:
-        await authz.verify(
-            auth,
-            ["auth:admin", "auth:org:*"],
-            match=permutil.has_any,
-            host=request.headers.get("host"),
-        )
     return FileResponse(frontend.file("admin/index.html"))
-    except HTTPException as e:
-        return FileResponse(
-            frontend.file("restricted", "index.html"), status_code=e.status_code
-        )
 
 
 # -------------------- Organizations --------------------

passkey/fastapi/mainapp.py

@@ -65,16 +65,10 @@ app.mount(
 @app.get("/")
 @app.get("/auth/")
 async def frontapp(request: Request, response: Response, auth=AUTH_COOKIE):
-    """Serve the user profile SPA only for authenticated sessions; otherwise restricted SPA.
+    """Serve the user profile app.
 
-    Login / authentication UX is centralized in the restricted app.
+    Access control is handled via APIs.
     """
-    if not auth:
-        return FileResponse(frontend.file("restricted", "index.html"), status_code=401)
-    from ..authsession import get_session  # local import
-
-    try:
-        await get_session(auth, host=request.headers.get("host"))
     cfg_host = hostutil.configured_auth_host()
     if cfg_host:
         cur_host = hostutil.normalize_host(request.headers.get("host"))
@@ -82,12 +76,6 @@ async def frontapp(request: Request, response: Response, auth=AUTH_COOKIE):
         if cur_host and cfg_normalized and cur_host != cfg_normalized:
             return FileResponse(frontend.file("host", "index.html"))
     return FileResponse(frontend.file("index.html"))
-    except Exception:
-        if auth:
-            from . import session as session_mod
-
-            session_mod.clear_session_cookie(response)
-        return FileResponse(frontend.file("restricted", "index.html"), status_code=401)
 
 
 @app.get("/admin", include_in_schema=False)
@@ -98,7 +86,7 @@ async def admin_root_redirect():
 
 @app.get("/admin/", include_in_schema=False)
 async def admin_root(request: Request, auth=AUTH_COOKIE):
-    return await admin.adminapp(request, auth)  # Delegated (enforces access control)
+    return await admin.adminapp(request, auth)  # Delegated to admin app
 
 
 @app.get("/auth/restricted")
@@ -115,7 +103,7 @@ async def restricted_api_view():
 @app.get("/{reset}")
 @app.get("/auth/{reset}")
 async def reset_link(reset: str):
-    """Serve the SPA directly with an injected reset token."""
+    """Serve the reset app directly with an injected reset token."""
     if not passphrase.is_well_formed(reset):
         raise HTTPException(status_code=404)
     return FileResponse(frontend.file("reset", "index.html"))