From cda765a02db7fec305c3810a46bb41caf4466bb7 Mon Sep 17 00:00:00 2001
From: Kfir Amar <kfira2002@gmail.com>
Date: Sun, 15 Mar 2026 01:17:04 +0200
Subject: [PATCH] fix(login): use public bootstrap settings

Point the login page at the existing public bootstrap endpoint
instead of the protected /api/settings route.

Also extend the public bootstrap response with hasPassword and
setupComplete so unauthenticated users get the correct first-run
or password-setup flow without triggering a 401.
---
 src/app/api/settings/require-login/route.ts | 9 +++++++--
 src/app/login/page.tsx                      | 2 +-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/app/api/settings/require-login/route.ts b/src/app/api/settings/require-login/route.ts
index 29dfa6b1..93415c72 100644
--- a/src/app/api/settings/require-login/route.ts
+++ b/src/app/api/settings/require-login/route.ts
@@ -8,9 +8,14 @@ export async function GET() {
   try {
     const settings = await getSettings();
     const requireLogin = settings.requireLogin !== false;
-    return NextResponse.json({ requireLogin });
+    const hasPassword = !!settings.password || !!process.env.INITIAL_PASSWORD;
+    const setupComplete = !!settings.setupComplete;
+    return NextResponse.json({ requireLogin, hasPassword, setupComplete });
   } catch (error) {
-    return NextResponse.json({ requireLogin: true }, { status: 200 });
+    return NextResponse.json(
+      { requireLogin: true, hasPassword: true, setupComplete: true },
+      { status: 200 }
+    );
   }
 }
 
diff --git a/src/app/login/page.tsx b/src/app/login/page.tsx
index cac7cc8c..f5cb661c 100644
--- a/src/app/login/page.tsx
+++ b/src/app/login/page.tsx
@@ -24,7 +24,7 @@ export default function LoginPage() {
       const baseUrl = typeof window !== "undefined" ? window.location.origin : "";
 
       try {
-        const res = await fetch(`${baseUrl}/api/settings`, {
+        const res = await fetch(`${baseUrl}/api/settings/require-login`, {
           signal: controller.signal,
         });
         clearTimeout(timeoutId);