[FEATURE] Expose installed Tinyauth version via `/api/context/app` API endpoint

[crivchri]

Is your feature request related to a problem? Please describe.

I use Argus to monitor GitHub releases, and I am always frustrated that the /api/context/app API endpoint does not return the currently installed Tinyauth version.

Describe the solution you'd like.

I would suggest to add the Tinyauth version to the /api/context/app endpoint.

This would allow tools such as Argus to reliably determine the installed version and notify users about available updates.

Thank you for considering this feature request and kind regards!

Describe alternatives you've considered.

No response

Additional context

No response

Human Written Confirmation

• I confirm this request was written by me and not generated by an LLM or AI assistant.

[steveiliop56]

Hello @crivchri,

Yep that does sound like a good idea. Although it would have to be protected, not available to everyone. This is because a version of Tinyauth may include a specific vulnerability and a public version endpoint gives an attacker an easy way to see if any vulnerabilities are present in that version.

[crivchri]

Hello @crivchri,

Yep that does sound like a good idea. Although it would have to be protected, not available to everyone. This is because a version of Tinyauth may include a specific vulnerability and a public version endpoint gives an attacker an easy way to see if any vulnerabilities are present in that version.

Hi @steveiliop56,

You're absolutely right. I was under the impression that the /api/context/app endpoint was protected, but it turns out it isn't.
Do you think this endpoint should be protected, as it returns other sensitive information?

Kind regards.

[steveiliop56]

Nope, the app context endpoint is public by design to provide the necessary information for the fontend to work for unauthenticated users.

[crivchri]

Nope, the app context endpoint is public by design to provide the necessary information for the fontend to work for unauthenticated users.

Hi @steveiliop56,

Is there another protected endpoint, which could expose the version?

[steveiliop56]

Yep, we can do it at the /api/user/context endpoint or we can just add a new protected endpoint for /api/version (I will probably do the second one).

[crivchri]

Yep, we can do it at the /api/user/context endpoint or we can just add a new protected endpoint for /api/version (I will probably do the second one).

Hi @steveiliop56,

Sounds great, thank you.
Could this be implemented by next release?

Thank you in advance and kind regards!

[steveiliop56]

Will try to include it if I have time.