[bug] Don't allow per user auth with accounts disabled

fe1f9fafbd3f93726a5bd4b676463dd162411abb

Cohee <18619528+Cohee1207@users.noreply.github.com>

server.js+3 -1 Viewed

+    }
     if (basicAuthMode) {
         if (!perUserBasicAuth && !enableAccounts) {
 +            console.error(color.red('Per-user basic authentication is enabled, but user accounts are disabled. This configuration may be insecure.'));
 +        } else if (!perUserBasicAuth) {
             const basicAuthUser = getConfigValue('basicAuthUser', {});
             if (!basicAuthUser?.username || !basicAuthUser?.password) {
                 console.warn(color.yellow('Basic Authentication is enabled, but username or password is not set or empty!'));

src/middleware/basicAuth.js+4 -2 Viewed

 const storage = require('node-persist');
 const PER_USER_BASIC_AUTH = getConfigValue('perUserBasicAuth', false);
 +const ENABLE_ACCOUNTS = getConfigValue('enableUserAccounts', false);
 const unauthorizedResponse = (res) => {
     res.set('WWW-Authenticate', 'Basic realm="SillyTavern", charset="UTF-8"');

         return unauthorizedResponse(response);
+    }
 +    const usePerUserAuth = PER_USER_BASIC_AUTH && ENABLE_ACCOUNTS;
     const [username, password] = Buffer.from(credentials, 'base64')
         .toString('utf8')
         .split(':');
     if (!PER_USER_BASIC_AUTHusePerUserAuth && username === config.basicAuthUser.username && password === config.basicAuthUser.password) {
         return callback();
     } else if (PER_USER_BASIC_AUTHusePerUserAuth) {
         const userHandles = await getAllUserHandles();
         for (const userHandle of userHandles) {
             if (username === userHandle) {