Enhance authentication requirements for root and agentgraph endpoints

- Update root endpoint to require authentication, adding comments for clarity.
- Modify agentgraph endpoint documentation to indicate authentication necessity.
- Remove root and agentgraph from excluded paths in authentication middleware to enforce security.

backend/app.py

@@ -122,9 +122,11 @@ async def shutdown_event():
     # scheduler_service.stop() # This line is now commented out
 
 
-# Root redirect to React app
+# Root redirect to React app (requires authentication)
 @app.get("/")
-async def root():
+async def root(request: Request):
+    # This endpoint will be protected by authentication middleware
+    # If user reaches here, they are authenticated
     return RedirectResponse(url="/agentgraph")
 
 

backend/middleware/auth.py

@@ -29,7 +29,6 @@ class ConditionalAuthMiddleware(BaseHTTPMiddleware):
         
         # Paths that don't require authentication even in HF Spaces
         self.excluded_paths = excluded_paths or [
-            "/",
             "/docs",
             "/redoc", 
             "/openapi.json",
@@ -38,9 +37,11 @@ class ConditionalAuthMiddleware(BaseHTTPMiddleware):
             "/auth/login",
             "/auth/callback",
             "/auth/logout",
+            "/auth/login-page",
+            "/auth/status",
             "/assets/",
             "/static/",
-            "/agentgraph",  # Allow React app to load
+            # Note: Removed "/" and "/agentgraph" to force authentication
         ]
         
         # Check if auth should be enabled
@@ -61,6 +62,7 @@ class ConditionalAuthMiddleware(BaseHTTPMiddleware):
         """
         # If auth is disabled (local dev), bypass all authentication
         if not self.auth_enabled:
+            logger.debug(f"🏠 Auth disabled - allowing {request.url.path}")
             return await call_next(request)
         
         # If auth is enabled but OAuth not properly configured, log warning and continue
@@ -70,8 +72,12 @@ class ConditionalAuthMiddleware(BaseHTTPMiddleware):
         
         # Check if path is excluded from authentication
         if self._is_excluded_path(request.url.path):
+            logger.debug(f"🚪 Excluded path - allowing {request.url.path}")
             return await call_next(request)
         
+        # Log the authentication check
+        logger.info(f"🔐 Checking authentication for {request.url.path}")
+        
         # Check user authentication
         user = await self._get_current_user(request)
         if not user:

backend/routers/agentgraph.py

@@ -6,7 +6,7 @@ router = APIRouter()
 
 @router.get("/agentgraph", response_class=HTMLResponse)
 async def agentgraph_interface(request: Request):
-    """Serve the React-based AgentGraph interface"""
+    """Serve the React-based AgentGraph interface (requires authentication)"""
     # Serve the built React app from the new location
     dist_path = "frontend/dist/index.html"
     if os.path.exists(dist_path):