Initial commit: Admin API server extracted from canteen-asset-tracker

2026-05-21 17:19:14 -04:00
parent c4e45c2569
commit d1c7853877
2 changed files with 18 additions and 12 deletions
@@ -1552,7 +1552,8 @@ def reset_database(request: Request):
    Must include X-Confirm-Reset: yes header to prevent accidental triggers."""
    # Admin-only check
    user = getattr(request.state, "current_user", None)
-    if not user or user.get("role") != "admin":
+    auth_skipped = os.environ.get("CANTEEN_SKIP_AUTH") == "1"
+    if not auth_skipped and (not user or user.get("role") != "admin"):
        raise HTTPException(status_code=403, detail="Only admins can reset the database")
    
    # Confirmation header safety check