feat: allow temporary intranet no-login mode

backend/tests/test_auth_disabled.py

@@ -0,0 +1,29 @@
+"""Authentication switch behavior."""
+
+import pytest
+from fastapi import HTTPException
+
+from app.config import settings
+from app.core.auth import get_current_user
+from app.models.user import UserRoleEnum
+
+
+@pytest.mark.asyncio
+async def test_auth_disabled_provides_local_admin_without_token(monkeypatch):
+    monkeypatch.setattr(settings, "auth_enabled", False)
+
+    user = await get_current_user(credentials=None, db=None)
+
+    assert user.id == 0
+    assert user.username == "local-admin"
+    assert user.role == UserRoleEnum.admin
+
+
+@pytest.mark.asyncio
+async def test_auth_enabled_still_requires_a_token(monkeypatch):
+    monkeypatch.setattr(settings, "auth_enabled", True)
+
+    with pytest.raises(HTTPException) as exc_info:
+        await get_current_user(credentials=None, db=None)
+
+    assert exc_info.value.status_code == 401