auth: no basic authentication offered to the dashboard

What is meant for browsers logs in on its page (/login), with the
passwords of --htpasswd; basic authentication's challenge stays for the
API, so curl -u keeps working. 1164 kept it from a page's own requests;
now nothing under /admin/dashboard is challenged either, whatever the
request: a browser opening the page without a user is sent to /login,
anything else answered 401 without a challenge.

1 files changed, 10 insertions, 7 deletions

diff --git a/src/api/auth.rs b/src/api/auth.rs
index acf9d46..a5a987c 100644
--- a/src/api/auth.rs
+++ b/src/api/auth.rs
@@ -316,14 +316,17 @@ pub(crate) async fn basic_auth(
             )
                 .into_response();
         }
-        // A challenge only where basic authentication can answer it, and not to a page's
-        // own requests (`Sec-Fetch-Dest: empty`: fetch, EventSource): the browser would
-        // ask for a password over the page, which has its own login (`/login`).
-        let from_a_page = headers
-            .get("sec-fetch-dest")
-            .is_some_and(|dest| dest == "empty");
+        // A challenge only where basic authentication can answer it, for the API (curl),
+        // never for what is meant for browsers: the dashboard, nor a page's own requests
+        // (`Sec-Fetch-Dest: empty`: fetch, EventSource). The browser would ask for a
+        // password over the page, which has its own login (`/login`), taking the
+        // passwords of the same file.
+        let for_browsers = request.uri().path().starts_with("/admin/dashboard")
+            || headers
+                .get("sec-fetch-dest")
+                .is_some_and(|dest| dest == "empty");
         return match state.users {
-            Some(_) if !from_a_page => (
+            Some(_) if !for_browsers => (
                 StatusCode::UNAUTHORIZED,
                 [(WWW_AUTHENTICATE, r#"Basic realm="Restricted""#)],
                 "Unauthorized",