fix(webui): fail closed on incomplete auth credentials

Supplying only --auth-user or only --auth-pass (or only one of
SKILLOPT_WEBUI_USER / SKILLOPT_WEBUI_PASS) previously left auth=None and still
launched the UI — a deployment could expose the training controls without login.
Now reject before building/launching (sys.exit 1); launch() is never called for
incomplete credentials. Added user-only / pass-only / env-incomplete regressions.

Author: WODE25500

skillopt_webui/app.py

@@ -700,9 +700,18 @@ def main():
 
     auth_user = args.auth_user or os.environ.get("SKILLOPT_WEBUI_USER")
     auth_pass = args.auth_pass or os.environ.get("SKILLOPT_WEBUI_PASS")
-    auth = None
-    if auth_user and auth_pass:
-        auth = (auth_user, auth_pass)
+    # Fail-closed: authentication requires BOTH credentials. Supplying only a
+    # username or only a password must not silently launch the UI unauthenticated
+    # (a deployment could expose the training controls without login).
+    if bool(auth_user) != bool(auth_pass):
+        print(
+            "SKILLOPT_WEBUI authentication requires BOTH --auth-user and "
+            "--auth-pass (or SKILLOPT_WEBUI_USER and SKILLOPT_WEBUI_PASS). "
+            "Refusing to start with incomplete credentials.",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    auth = (auth_user, auth_pass) if auth_user else None
 
     app = build_ui()
     launch_kwargs = build_launch_kwargs(args.host, args.port, args.share)

tests/test_webui_security.py

@@ -157,3 +157,59 @@ def test_scan_outputs_allows_valid_subdir(webui, tmp_path, monkeypatch):
     except ValueError:
         contained = False
     assert contained, "Valid subdirectory must pass containment check"
+
+
+def test_main_rejects_incomplete_cli_auth_user_only(webui, monkeypatch):
+    """--auth-user without --auth-pass must fail closed (never launch)."""
+    webui_mod = webui
+    launcher = mock.MagicMock()
+    app_mock = mock.MagicMock()
+    app_mock.launch = launcher
+    monkeypatch.setattr(webui_mod, "build_ui", lambda: app_mock)
+    monkeypatch.setattr(sys, "argv", ["app.py", "--host", "0.0.0.0", "--auth-user", "admin"])
+    with pytest.raises(SystemExit):
+        webui_mod.main()
+    launcher.assert_not_called()
+
+
+def test_main_rejects_incomplete_cli_auth_pass_only(webui, monkeypatch):
+    """--auth-pass without --auth-user must fail closed (never launch)."""
+    webui_mod = webui
+    launcher = mock.MagicMock()
+    app_mock = mock.MagicMock()
+    app_mock.launch = launcher
+    monkeypatch.setattr(webui_mod, "build_ui", lambda: app_mock)
+    monkeypatch.setattr(sys, "argv", ["app.py", "--host", "0.0.0.0", "--auth-pass", "s3cret"])
+    with pytest.raises(SystemExit):
+        webui_mod.main()
+    launcher.assert_not_called()
+
+
+def test_main_rejects_incomplete_env_auth_user_only(webui, monkeypatch):
+    """Only SKILLOPT_WEBUI_USER set must fail closed (never launch)."""
+    webui_mod = webui
+    launcher = mock.MagicMock()
+    app_mock = mock.MagicMock()
+    app_mock.launch = launcher
+    monkeypatch.setattr(webui_mod, "build_ui", lambda: app_mock)
+    monkeypatch.setattr(sys, "argv", ["app.py", "--host", "0.0.0.0"])
+    monkeypatch.setenv("SKILLOPT_WEBUI_USER", "envuser")
+    monkeypatch.delenv("SKILLOPT_WEBUI_PASS", raising=False)
+    with pytest.raises(SystemExit):
+        webui_mod.main()
+    launcher.assert_not_called()
+
+
+def test_main_rejects_incomplete_env_auth_pass_only(webui, monkeypatch):
+    """Only SKILLOPT_WEBUI_PASS set must fail closed (never launch)."""
+    webui_mod = webui
+    launcher = mock.MagicMock()
+    app_mock = mock.MagicMock()
+    app_mock.launch = launcher
+    monkeypatch.setattr(webui_mod, "build_ui", lambda: app_mock)
+    monkeypatch.setattr(sys, "argv", ["app.py", "--host", "0.0.0.0"])
+    monkeypatch.setenv("SKILLOPT_WEBUI_PASS", "envpass")
+    monkeypatch.delenv("SKILLOPT_WEBUI_USER", raising=False)
+    with pytest.raises(SystemExit):
+        webui_mod.main()
+    launcher.assert_not_called()