fix(server): remove auth from proceed-db-migration endpoint (#8930)

* fix(server): remove auth from proceed-db-migration endpoint

  * Auth tables may not exist when migration is pending, causing a bootstrap deadlock
  * Restores pre-auth-hardening behavior for the idempotent migration endpoint

Signed-off-by: Joshua Smith <jbsmith7741@gmail.com>

* fix(server): add proceed-db-migration to publicPaths

Signed-off-by: Joshua Smith <jbsmith7741@gmail.com>

---------

Signed-off-by: Joshua Smith <jbsmith7741@gmail.com>

Author: jbsmith7741

backend/server/api/api.go

@@ -127,8 +127,9 @@ func SetupApiServer(router *gin.Engine) {
 	router.UseRawPath = true
 	// router.UnescapePathValues = false
 
-	// Endpoint to proceed database migration (now requires authentication)
-	router.GET("/proceed-db-migration", auth.RequireAuth(), func(ctx *gin.Context) {
+	// Endpoint to proceed database migration — listed in auth.publicPaths because
+	// auth tables may not exist yet when migration is pending.
+	router.GET("/proceed-db-migration", func(ctx *gin.Context) {
 		// Execute database migration
 		errors.Must(services.ExecuteMigration())
 		// Return success response

backend/server/api/auth/middleware.go

@@ -34,15 +34,16 @@ import (
 // and clear its session even when the cookie has lapsed; both handlers
 // short-circuit gracefully when no user is set.
 var publicPaths = map[string]struct{}{
-	"/ping":      {},
-	"/ready":     {},
-	"/health":    {},
-	"/version":   {},
-	PathMethods:  {},
-	PathLogin:    {},
-	PathCallback: {},
-	PathLogout:   {},
-	PathUserInfo: {},
+	"/ping":                 {},
+	"/ready":                {},
+	"/health":               {},
+	"/version":              {},
+	"/proceed-db-migration": {},
+	PathMethods:             {},
+	PathLogin:               {},
+	PathCallback:            {},
+	PathLogout:              {},
+	PathUserInfo:            {},
 }
 
 func OIDCAuthentication() gin.HandlerFunc { return defaultService.OIDCAuthentication() }