From a565e40a06ced67d13e438238a0a334edba48bf7 Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Thu, 22 Feb 2018 02:45:30 -0600
Subject: [PATCH] prevent basic enforced in dev mode

---
 app/rest/auth/auth.go | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/app/rest/auth/auth.go b/app/rest/auth/auth.go
index 06543bd7..ce2b3ecc 100644
--- a/app/rest/auth/auth.go
+++ b/app/rest/auth/auth.go
@@ -37,18 +37,17 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler {
 	f := func(h http.Handler) http.Handler {
 		fn := func(w http.ResponseWriter, r *http.Request) {
 
-			// dev user - skip regular auth check and populate dev to context
-			if a.basicDevUser(w, r) {
-				user := devUser
-				ctx := r.Context()
-				ctx = context.WithValue(ctx, rest.ContextKey("user"), user)
-				r = r.WithContext(ctx)
-				h.ServeHTTP(w, r)
-				return
-			}
-
 			session, err := a.SessionStore.Get(r, "remark")
 			if err != nil && reqAuth { // in full auth lack of session causes Unauthorized
+				if a.basicDevUser(w, r) { // fail-back to dev user if enabled
+					user := devUser
+					ctx := r.Context()
+					ctx = context.WithValue(ctx, rest.ContextKey("user"), user)
+					r = r.WithContext(ctx)
+					h.ServeHTTP(w, r)
+					return
+				}
+
 				http.Error(w, "Unauthorized", http.StatusUnauthorized)
 				return
 			}