feat(web): make the house password optional for private LAN consent

[frahlg]

Problem and result

On v0.150.0-beta.1, “Accept Cloud terms” refused a LAN user until the house password was on. Settings then refused to set the first password from that same LAN page. Fredrik had to use an SSH tunnel to complete the choice.

Make the house password optional for consent on the direct private LAN, as it is for Settings and owner pairing. When password protection is on, the existing login dialog authenticates the owner and retries the choice. This covers both Cloud terms and local statistics sharing.

The card now gives a short summary, says that Sourceful can read the Cloud copy, keeps the full sharing and retention text in a disclosure, and shows whether login is needed. A save has a clear receipt. A failed save has one error and allows a retry; a refresh during login cannot remove that error or replace the pending choice.

Scope and safety

This changes who may grant Cloud access. With the house password off, any client that can reach the box directly on a private network, including a private VPN, may accept the terms, enable Cloud or enable statistics. The card states that tradeoff. With protection on, a LAN write still requires the password, an existing login cookie or the configured API token. Owner app sessions keep their role check.

Public clients, public hostnames, forwarding headers, CGNAT clients, cross-site browser requests and non-JSON writes do not gain access. First password setup retains its local-only rule. The PR removes the forced trip through that setup from Cloud consent.

Open PR #1177 owns the System tab, #1694 owns shared dashboard CSS, and #1632 owns ADR 0008. This change keeps the UI in its statistics module and updates the normative Cloud protocol document.

Verification

• npm test: 770 passed.
• go test ./internal/api -run 'Cloud|Statistics|AuthPassword' -count=1: passed.
• make verify: passed.
• GitHub CI: all checks passed on 139c6849, including the Go race detector and full stack.
• The new LAN regression test fails with the previous API implementation: both consent writes return 403 where the test expects 200.
• Router tests cover private IPv4/IPv6, password-off consent, protected consent before and after real cookie login, correct and wrong Bearers, public/CGNAT/proxy requests, cross-site requests and body type. Refused requests never call the Cloud writer.
• Browser checks use the branch’s API, authentication middleware, HTML, CSS and scripts with isolated SQLite stores, a fake Cloud writer and a private client address. Tested direct consent, login and retry, a failed save followed by success, local No, expanded details, dark/light themes and 1280/390 px layouts. At 390 px the card is 366 px wide and the page has no horizontal scroll. No real Cloud grant was changed by these tests.

Checklist

• The change follows VISION.md and one selected scope.
• I checked overlapping PRs and coordinated shared files/contracts.
• Relevant checks cover the changed behaviour and failure paths.
• A human reviewed changed UI in a browser, or no UI changed.
• A Changeset is included, or the change is exempt.
• Every commit has a DCO sign-off.

The rendered views and a local preview are available in the chat for human UI review. The changeset is minor. Fredrik approved the described change to LAN consent authority and requested merge in the chat on 17 October 2026. Human UI review may follow on beta under the repository’s review policy.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T17:27:46.868560Z	139c684	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.