fix: cover other paths by auth

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

Author: mudler

core/http/app.go

@@ -267,7 +267,8 @@ func API(application *application.Application) (*echo.Echo, error) {
 		opcache = services.NewOpCache(application.GalleryService())
 	}
 
-	routes.RegisterLocalAIRoutes(e, requestExtractor, application.ModelConfigLoader(), application.ModelLoader(), application.ApplicationConfig(), application.GalleryService(), opcache, application.TemplatesEvaluator(), application, adminMiddleware, mcpJobsMw)
+	mcpMw := auth.RequireFeature(application.AuthDB(), auth.FeatureMCP)
+	routes.RegisterLocalAIRoutes(e, requestExtractor, application.ModelConfigLoader(), application.ModelLoader(), application.ApplicationConfig(), application.GalleryService(), opcache, application.TemplatesEvaluator(), application, adminMiddleware, mcpJobsMw, mcpMw)
 	routes.RegisterAgentPoolRoutes(e, application, agentsMw, skillsMw, collectionsMw)
 	routes.RegisterOpenAIRoutes(e, requestExtractor, application)
 	routes.RegisterAnthropicRoutes(e, requestExtractor, application)

core/http/auth/apikeys.go

@@ -74,6 +74,10 @@ func ValidateAPIKey(db *gorm.DB, plaintext string) (*UserAPIKey, error) {
 		return nil, fmt.Errorf("invalid API key")
 	}
 
+	if key.User.Status != StatusActive {
+		return nil, fmt.Errorf("user account is not active")
+	}
+
 	// Update LastUsed
 	now := time.Now()
 	db.Model(&key).Update("last_used", now)

core/http/auth/db_test.go

@@ -40,7 +40,7 @@ var _ = Describe("InitDB", func() {
 				Provider: "github",
 				Subject:  "12345",
 				Role:     "admin",
-				Status:   "active",
+				Status:   auth.StatusActive,
 			}
 			Expect(db.Create(user).Error).ToNot(HaveOccurred())
 

core/http/auth/features.go

@@ -62,6 +62,29 @@ var RouteFeatureRegistry = []RouteFeature{
 
 	// Sound generation
 	{"POST", "/v1/sound-generation", FeatureSound},
+
+	// Realtime
+	{"GET", "/v1/realtime", FeatureRealtime},
+	{"POST", "/v1/realtime/sessions", FeatureRealtime},
+	{"POST", "/v1/realtime/transcription_session", FeatureRealtime},
+	{"POST", "/v1/realtime/calls", FeatureRealtime},
+
+	// MCP
+	{"POST", "/v1/mcp/chat/completions", FeatureMCP},
+	{"POST", "/mcp/v1/chat/completions", FeatureMCP},
+	{"POST", "/mcp/chat/completions", FeatureMCP},
+
+	// Tokenize
+	{"POST", "/v1/tokenize", FeatureTokenize},
+
+	// Rerank
+	{"POST", "/v1/rerank", FeatureRerank},
+
+	// Stores
+	{"POST", "/stores/set", FeatureStores},
+	{"POST", "/stores/delete", FeatureStores},
+	{"POST", "/stores/get", FeatureStores},
+	{"POST", "/stores/find", FeatureStores},
 }
 
 // FeatureMeta describes a feature for the admin API/UI.
@@ -93,5 +116,10 @@ func APIFeatureMetas() []FeatureMeta {
 		{FeatureVideo, "Video Generation", true},
 		{FeatureEmbeddings, "Embeddings", true},
 		{FeatureSound, "Sound Generation", true},
+		{FeatureRealtime, "Realtime", true},
+		{FeatureRerank, "Rerank", true},
+		{FeatureTokenize, "Tokenize", true},
+		{FeatureMCP, "MCP", true},
+		{FeatureStores, "Stores", true},
 	}
 }

core/http/auth/helpers_test.go

@@ -29,7 +29,7 @@ func createTestUser(db *gorm.DB, email, role, provider string) *auth.User {
 		Provider: provider,
 		Subject:  generateTestID(),
 		Role:     role,
-		Status:   "active",
+		Status:   auth.StatusActive,
 	}
 	err := db.Create(user).Error
 	Expect(err).ToNot(HaveOccurred())

core/http/auth/middleware.go

@@ -473,7 +473,10 @@ func isAPIPath(path string) bool {
 		strings.HasPrefix(path, "/vad") ||
 		strings.HasPrefix(path, "/video") ||
 		strings.HasPrefix(path, "/stores/") ||
-		strings.HasPrefix(path, "/system")
+		strings.HasPrefix(path, "/system") ||
+		strings.HasPrefix(path, "/ws/") ||
+		strings.HasPrefix(path, "/generated-") ||
+		path == "/metrics"
 }
 
 // authError returns an appropriate error response.

core/http/auth/oauth.go

@@ -211,15 +211,15 @@ func (m *OAuthManager) CallbackHandler(providerName string, db *gorm.DB, adminEm
 		}
 
 		// For new users that are pending, check if they have a valid invite
-		if user.Status != "active" && inviteCode != "" {
+		if user.Status != StatusActive && inviteCode != "" {
 			if invite, err := ValidateInvite(db, inviteCode); err == nil {
-				user.Status = "active"
-				db.Model(user).Update("status", "active")
+				user.Status = StatusActive
+				db.Model(user).Update("status", StatusActive)
 				ConsumeInvite(db, invite, user.ID)
 			}
 		}
 
-		if user.Status != "active" {
+		if user.Status != StatusActive {
 			if registrationMode == "invite" {
 				return c.JSON(http.StatusForbidden, map[string]string{"error": "a valid invite code is required to register"})
 			}
@@ -383,15 +383,15 @@ func upsertOAuthUser(db *gorm.DB, provider string, info *oauthUserInfo, adminEma
 	}
 
 	// New user
-	status := "active"
+	status := StatusActive
 	if registrationMode == "approval" || registrationMode == "invite" {
-		status = "pending"
+		status = StatusPending
 	}
 
 	role := AssignRole(db, info.Email, adminEmail)
 	// First user is always active regardless of registration mode
 	if role == RoleAdmin {
-		status = "active"
+		status = StatusActive
 	}
 
 	user = User{

core/http/auth/permissions.go

@@ -42,6 +42,11 @@ const (
 	FeatureVideo             = "video"
 	FeatureEmbeddings        = "embeddings"
 	FeatureSound             = "sound"
+	FeatureRealtime          = "realtime"
+	FeatureRerank            = "rerank"
+	FeatureTokenize          = "tokenize"
+	FeatureMCP               = "mcp"
+	FeatureStores            = "stores"
 )
 
 // AgentFeatures lists agent-related features (default OFF).
@@ -51,6 +56,7 @@ var AgentFeatures = []string{FeatureAgents, FeatureSkills, FeatureCollections, F
 var APIFeatures = []string{
 	FeatureChat, FeatureImages, FeatureAudioSpeech, FeatureAudioTranscription,
 	FeatureVAD, FeatureDetection, FeatureVideo, FeatureEmbeddings, FeatureSound,
+	FeatureRealtime, FeatureRerank, FeatureTokenize, FeatureMCP, FeatureStores,
 }
 
 // AllFeatures lists all known features (used by UI and validation).

core/http/auth/roles.go

@@ -11,6 +11,10 @@ import (
 const (
 	RoleAdmin = "admin"
 	RoleUser  = "user"
+
+	StatusActive   = "active"
+	StatusPending  = "pending"
+	StatusDisabled = "disabled"
 )
 
 // AssignRole determines the role for a new user.

core/http/auth/session.go

@@ -47,6 +47,9 @@ func ValidateSession(db *gorm.DB, sessionID string) *User {
 	if err := db.Preload("User").Where("id = ? AND expires_at > ?", sessionID, time.Now()).First(&session).Error; err != nil {
 		return nil
 	}
+	if session.User.Status != StatusActive {
+		return nil
+	}
 	return &session.User
 }