fix(web): simplify first-time token sign-in

2026-10-14 18:43:06 -07:00
parent 844f48e9e0
commit 2e62bfa736
5 changed files with 71 additions and 18 deletions
@@ -23,6 +23,8 @@ Chat upload limits:

 ### `GET /v1/auth/session`
 - Response: `{ "authenticated": true, "mode": "open" | "token" }`
+- In token mode, a missing bearer token returns `401` (`missing bearer token`); an incorrect token returns `403` (`invalid bearer token`).
+- Web clients show a neutral sign-in form when the initial check has no token, and an error when a supplied token is rejected. Open development servers authenticate automatically; the sign-in form has no tokenless bypass.

 ## Models

@@ -15,6 +15,7 @@ Transport:

 Authentication:
 - Same as REST endpoints (`Authorization: Bearer <token>` when token mode is enabled)
+- The web client checks [`GET /v1/auth/session`](rest.md#get-v1authsession) before opening streams. An initial missing-token response prompts sign-in without an error; an incorrect supplied token is an authentication failure. The web sign-in form has no tokenless bypass; open development servers still authenticate automatically. Stream authorization requirements are unchanged.

 ## Chat Completion Request Body