fix(http): block /install page after setup is complete

- skip SPA fallback for `/install` and `/install/*` in main server
- keep install wizard accessible only during `RunInstallServer` phase
- prevent post-install access to install UI
This commit is contained in:
line-6000
2026-04-23 00:39:22 +08:00
parent 3a3a830d93
commit 09514a6946
175 changed files with 598 additions and 232 deletions
+2
View File
@@ -188,6 +188,8 @@ func registerAdminRoutes(e *echo.Echo) {
// Public (no JWT)
adminV1.POST("/auth/login", admin.Ctrl.Login)
adminV1.GET("/auth/init-password", admin.Ctrl.GetInitialPassword)
adminV1.GET("/auth/init-password-hash", admin.Ctrl.GetInitialPasswordHash)
// Authenticated
authed := adminV1.Group("", middleware.CheckAdminJWT())