[bug] Don't allow per user auth with accounts disabled

fe1f9fafbd3f93726a5bd4b676463dd162411abb

Cohee <18619528+Cohee1207@users.noreply.github.com>

server.js+3 -1 Viewed

+    }
     if (basicAuthMode) {
-        if (!perUserBasicAuth) {
+        if (perUserBasicAuth && !enableAccounts) {
+            console.error(color.red('Per-user basic authentication is enabled, but user accounts are disabled. This configuration may be insecure.'));
+        } else if (!perUserBasicAuth) {
             const basicAuthUser = getConfigValue('basicAuthUser', {});
             if (!basicAuthUser?.username || !basicAuthUser?.password) {
                 console.warn(color.yellow('Basic Authentication is enabled, but username or password is not set or empty!'));

src/middleware/basicAuth.js+4 -2 Viewed

 const storage = require('node-persist');
 const PER_USER_BASIC_AUTH = getConfigValue('perUserBasicAuth', false);
+const ENABLE_ACCOUNTS = getConfigValue('enableUserAccounts', false);
 const unauthorizedResponse = (res) => {
     res.set('WWW-Authenticate', 'Basic realm="SillyTavern", charset="UTF-8"');

         return unauthorizedResponse(response);
+    }
+    const usePerUserAuth = PER_USER_BASIC_AUTH && ENABLE_ACCOUNTS;
     const [username, password] = Buffer.from(credentials, 'base64')
         .toString('utf8')
         .split(':');
-    if (!PER_USER_BASIC_AUTH && username === config.basicAuthUser.username && password === config.basicAuthUser.password) {
+    if (!usePerUserAuth && username === config.basicAuthUser.username && password === config.basicAuthUser.password) {
         return callback();
-    } else if (PER_USER_BASIC_AUTH) {
+    } else if (usePerUserAuth) {
         const userHandles = await getAllUserHandles();
         for (const userHandle of userHandles) {
             if (username === userHandle) {