v1.8.3

v1.8.3 — Login gate reliability fixes

Fixes a redirect loop that could leave users stuck on the login page after entering correct credentials when the login gate is enabled, plus hardens session-cookie handling for HTTP/LAN self-hosted deployments.

🐛 Fixes

• Login redirect loop when the login gate is enabled. After signing in with valid credentials the API returned success, but you were bounced straight back to /login. The frontend proxy verified the session JWT locally, which silently failed whenever the frontend process didn't share the backend's SYNAPSE_JWT_SECRET (they run as separate processes). Session validation is now delegated to the backend — the single owner of the secret — via /api/auth/status, so a missing or mismatched frontend secret can no longer cause the loop. The local JWT check is kept as a zero-latency fast path when the secret is present, and fail-open on an unreachable backend is preserved.
• Session cookie dropped on plain-HTTP / LAN installs. The synapse_session cookie's Secure flag was tied to NODE_ENV=production, so self-hosted deployments served over plain HTTP couldn't store it — another route into the login loop. It now keys off the actual request protocol and honors x-forwarded-proto behind a TLS-terminating reverse proxy.

🔒 Hardening

• /api/v2/ now bypasses the login gate in the frontend proxy, consistent with /api/v1/ and the backend InternalTokenMiddleware (versioned APIs authenticate via Bearer API key). No behavior change in practice — defense-in-depth.
• The login page runs router.refresh() after redirecting, so the RSC router cache re-fetches with the freshly-set session cookie present.

✅ Tests

• New backend/tests/api_v1/test_auth_gate.py covering /api/auth/status authentication reporting: valid token, missing token, malformed token, mismatched-secret token, and login-disabled.

⬆️ Upgrading

This release includes frontend changes, so the frontend must be rebuilt/re-bundled.

• pip: pip install --upgrade synapse-orch-ai, then synapse start.
• terminal: synapse upgrade, then synapse start
• From source: cd frontend && npm run build, then synapse stop && synapse start.

No settings or data migration required, and existing sessions stay valid.

Full Changelog: v1.8.2...v1.8.3