The Login button (onclick=window.showAuthScreen()) was dead — showAuthScreen was defined but never exported via Object.assign. Also drop dead code from the e2e suite (unused createReadStream import, unused s3StreamRequest).
- /api/v1/* GET (list buckets/objects, download) no longer requires auth - POST/DELETE/PUT stay behind requireAuth (upload, create/delete bucket, copy, delete object) - FE drops blocking login screen: visitors browse + download freely - Admin-only UI (create bucket, upload dropzone, delete, S3 creds) hidden in read-only mode - Login button in topbar to unlock admin actions
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>