fix: fix tests and expectations

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

Author: mudler

core/http/app_test.go

@@ -428,8 +428,10 @@ var _ = Describe("API test", func() {
 					"X-Forwarded-Prefix": {"/myprefix/"},
 				})
 				Expect(err).To(BeNil(), "error")
-				Expect(sc).To(Equal(401), "status code")
+				Expect(sc).To(Equal(200), "status code")
+				// Non-API paths pass through to the React SPA (which handles login client-side)
 				Expect(string(body)).To(ContainSubstring(`<base href="https://example.org/myprefix/" />`), "body")
+				Expect(string(body)).To(ContainSubstring(`<div id="root">`), "should serve React SPA")
 			})
 
 			It("Should support reverse-proxy when authenticated", func() {

core/http/auth/middleware.go

@@ -85,19 +85,8 @@ func Middleware(db *gorm.DB, appConfig *config.ApplicationConfig) echo.Middlewar
 
 			// 5. Require auth for API paths
 			if isAPIPath(path) {
-				return authError(c, appConfig)
-			}
-
-			// 6. Pass through for non-API paths when auth is DB-based
-			// (the React UI will redirect to login as needed)
-			if authEnabled && !hasLegacyKeys {
-				return next(c)
-			}
-
-			// 7. Legacy behavior: if API keys are set, all paths require auth
-			if hasLegacyKeys {
-				// Check GET exemptions
-				if appConfig.DisableApiKeyRequirementForHttpGet && c.Request().Method == http.MethodGet {
+				// Check GET exemptions for legacy keys
+				if hasLegacyKeys && appConfig.DisableApiKeyRequirementForHttpGet && c.Request().Method == http.MethodGet {
 					for _, rx := range appConfig.HttpGetExemptedEndpoints {
 						if rx.MatchString(c.Path()) {
 							return next(c)
@@ -107,6 +96,8 @@ func Middleware(db *gorm.DB, appConfig *config.ApplicationConfig) echo.Middlewar
 				return authError(c, appConfig)
 			}
 
+			// 6. Non-API paths (UI, static assets) pass through.
+			// The React UI handles login redirects client-side.
 			return next(c)
 		}
 	}