Fix nil pointer panic in local auth mode #1

New issue

Open

opened 2026-03-16 21:05:27 +00:00 by austin · 0 comments

austin commented

2026-03-16 21:05:27 +00:00

Owner

Description

server.go:55 calls s.auth.Middleware() unconditionally. When running in local auth mode, s.auth is nil, so this panics on any authenticated API request.

What needs to happen

Define an Authenticator interface with Middleware(http.Handler) http.Handler and ValidateSession(token string) (*Claims, error) methods. Both Auth (OIDC) and Local should implement it. The Server struct stores the interface, not concrete types.

The session logic (CreateSessionToken, validateSession in internal/auth/oidc.go) is already auth-mode-agnostic — it just does base64 JSON, nothing OIDC-specific. Extract it to a shared location that both auth modes can use.

Key files

internal/api/server.go — the panic site (line 55) and route setup
internal/auth/oidc.go — session functions and Middleware method
internal/auth/local.go — needs Middleware and session validation added

## Description `server.go:55` calls `s.auth.Middleware()` unconditionally. When running in local auth mode, `s.auth` is nil, so this panics on any authenticated API request. ## What needs to happen Define an `Authenticator` interface with `Middleware(http.Handler) http.Handler` and `ValidateSession(token string) (*Claims, error)` methods. Both `Auth` (OIDC) and `Local` should implement it. The `Server` struct stores the interface, not concrete types. The session logic (`CreateSessionToken`, `validateSession` in `internal/auth/oidc.go`) is already auth-mode-agnostic — it just does base64 JSON, nothing OIDC-specific. Extract it to a shared location that both auth modes can use. ## Key files - `internal/api/server.go` — the panic site (line 55) and route setup - `internal/auth/oidc.go` — session functions and `Middleware` method - `internal/auth/local.go` — needs `Middleware` and session validation added