feat: remove ALLOW_UNAUTHENTICATED_SEARCH_API env var

users can set ADDON_PASSWORD if unauthenticated access is not desired

.env.sample

@@ -196,9 +196,6 @@ CUSTOM_HTML=
 # at the /api/v1/search endpoint. 
 # Enabled by default, set to false to disable.
 # ENABLE_SEARCH_API=true
-# Whether to allow unauthenticated requests to the Search API using just the x-aiostreams-user-data header.
-# If set to false, users must create a user first before being able to use the search API.
-# ALLOW_UNAUTHENTICATED_SEARCH_API=true
 
 # --- Regex Filter Access ---
 # Controls who can use regex filters.

packages/core/src/db/schemas.ts

@@ -892,7 +892,6 @@ const StatusResponseSchema = z.object({
     customHtml: z.string().optional(),
     protected: z.boolean(),
     regexFilterAccess: z.enum(['none', 'trusted', 'all']),
-    allowUnauthenticatedSearchApi: z.boolean(),
     allowedRegexPatterns: z
       .object({
         patterns: z.array(z.string()),

packages/core/src/utils/env.ts

@@ -368,10 +368,6 @@ export const Env = cleanEnv(process.env, {
     default: true,
     desc: 'Enable the search API. If true, the search API will be enabled.',
   }),
-  ALLOW_UNAUTHENTICATED_SEARCH_API: bool({
-    default: true,
-    desc: 'Allow unauthenticated search API requests. i.e. x-aiostreams-user-data header instead of basic auth',
-  }),
   // logging settings
   LOG_SENSITIVE_INFO: bool({
     default: false,

packages/server/src/routes/api/search.ts

@@ -54,7 +54,7 @@ router.get(
 
       let userData: UserData | null = null;
 
-      if (encodedUserData && Env.ALLOW_UNAUTHENTICATED_SEARCH_API) {
+      if (encodedUserData) {
         try {
           userData = JSON.parse(
             Buffer.from(encodedUserData, 'base64').toString('utf-8')

packages/server/src/routes/api/status.ts

@@ -33,7 +33,6 @@ const statusInfo = async (): Promise<StatusResponse> => {
       protected: Env.ADDON_PASSWORD.length > 0,
       tmdbApiAvailable: !!Env.TMDB_ACCESS_TOKEN,
       regexFilterAccess: Env.REGEX_FILTER_ACCESS,
-      allowUnauthenticatedSearchApi: Env.ALLOW_UNAUTHENTICATED_SEARCH_API,
       allowedRegexPatterns:
         (await FeatureControl.allowedRegexPatterns()).patterns.length > 0
           ? {