Two gaps found while wiring auth into the data routes:
1. mcp_server/auth.py: HTTPBearer() defaults to auto_error=True, which
rejects any request with no Authorization header before
get_current_user's own "auth not configured -> allow as guest"
check ever runs. That meant turning on Depends(get_current_user)
anywhere 401'd every request even with auth fully disabled.
Switched to auto_error=False and handle the missing-credentials
case explicitly inside get_current_user instead.
2. Frontend never actually sent the stored token on data requests.
auth.tsx only attached it to its own /api/auth/me check; api.ts's
fetch() calls (chat, stats, documents, upload, delete) and every
axios call elsewhere in the app (projects, kanban, hooks) had no
Authorization header at all. Added an authHeaders() helper in
api.ts, and a single axios request interceptor in auth.tsx that
attaches the token app-wide since every component imports the same
default axios instance.
Known gap not addressed here: mcp_server/claude_code_mcp.py (the
code-forge stdio MCP server) calls the REST API with no token at all.
Harmless while auth is disabled (current state), but it will start
getting 401'd the moment CLAUDE_OS_EMAIL/PASSWORD are actually set -
needs a service-token bypass if that's ever turned on.
api.ts and auth.tsx hardcoded API_BASE to http://localhost:8051 with
no override, unlike every other component which already checked
VITE_API_URL first. That's fine when the browser and server are on
the same machine, but breaks auth/chat/stats/documents entirely when
accessing the UI from a different machine than the one running
claude-os - "localhost" resolves to the browser's own machine, not
the server.
Also pins mcp<2.0.0 in requirements.txt: mcp 2.0.0 removed the
low-level Server.list_tools() API that mcp_server/claude_code_mcp.py
(the code-forge stdio MCP server) depends on, so an unbounded
mcp>=1.0.0 install silently breaks that integration.
Fixes#7
- Add frontend/src/lib/auth.tsx with AuthProvider and useAuth hook
- Add frontend/src/lib/api.ts with chat, getKBStats, listDocuments, etc.
- Add frontend/src/lib/filePicker.ts with path utilities
- Update .gitignore to not ignore frontend/src/lib/
These files were imported but never committed, preventing fresh
installations from building the frontend.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
