From 79ee009983e254ee6f96cf214d7e3812242e6a98 Mon Sep 17 00:00:00 2001
From: "Rodrigo Rodriguez (Pragmatismo)" <me@rodrigorodriguez.com>
Date: Sat, 10 Jan 2026 09:44:59 -0300
Subject: [PATCH] Fix: Add auth endpoints to anonymous paths list

- /api/auth/login was being blocked by auth middleware
- Add all auth endpoints to allow_anonymous_paths:
  - /api/auth/login
  - /api/auth/logout
  - /api/auth/refresh
  - /api/auth/bootstrap
  - /api/auth/2fa/verify
  - /api/auth/2fa/resend
  - /oauth
  - /auth/callback
---
 src/security/auth.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/security/auth.rs b/src/security/auth.rs
index aa8e18cf3..90ff4441c 100644
--- a/src/security/auth.rs
+++ b/src/security/auth.rs
@@ -530,6 +530,14 @@ impl Default for AuthConfig {
                 "/api/v1/health".to_string(),
                 "/.well-known".to_string(),
                 "/metrics".to_string(),
+                "/api/auth/login".to_string(),
+                "/api/auth/logout".to_string(),
+                "/api/auth/refresh".to_string(),
+                "/api/auth/bootstrap".to_string(),
+                "/api/auth/2fa/verify".to_string(),
+                "/api/auth/2fa/resend".to_string(),
+                "/oauth".to_string(),
+                "/auth/callback".to_string(),
             ],
             public_paths: vec![
                 "/".to_string(),