From 263c0f0dc98f2ebbcb4843e2893b268fb6f2dd63 Mon Sep 17 00:00:00 2001
From: hobokenchicken <dustin@dustin.coffee>
Date: Thu, 19 Mar 2026 12:35:14 -0400
Subject: [PATCH] fix: resolve dashboard 401 and 500 errors

Restricted AuthMiddleware to /v1 group to prevent dashboard session interference. Robustified analytics SQL queries with COALESCE to handle empty datasets.
---
 internal/server/dashboard.go | 4 ++--
 internal/server/server.go    | 4 +---
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/internal/server/dashboard.go b/internal/server/dashboard.go
index 59aeef54..a6a37f44 100644
--- a/internal/server/dashboard.go
+++ b/internal/server/dashboard.go
@@ -304,7 +304,7 @@ func (s *Server) handleTimeSeries(c *gin.Context) {
 
 	query := fmt.Sprintf(`
 		SELECT 
-			strftime('%%Y-%%m-%%d', timestamp) as bucket,
+			COALESCE(strftime('%%Y-%%m-%%d', timestamp), 'unknown') as bucket,
 			COUNT(*) as requests,
 			COALESCE(SUM(total_tokens), 0) as tokens,
 			COALESCE(SUM(cost), 0.0) as cost
@@ -444,7 +444,7 @@ func (s *Server) handleDetailedUsage(c *gin.Context) {
 
 	query := fmt.Sprintf(`
 		SELECT 
-			strftime('%%Y-%%m-%%d', timestamp) as date,
+			COALESCE(strftime('%%Y-%%m-%%d', timestamp), 'unknown') as date,
 			COALESCE(client_id, 'unknown') as client,
 			COALESCE(provider, 'unknown') as provider,
 			COALESCE(model, 'unknown') as model,
diff --git a/internal/server/server.go b/internal/server/server.go
index fda1562e..02a02c70 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -74,8 +74,6 @@ func NewServer(cfg *config.Config, database *db.DB) *Server {
 }
 
 func (s *Server) setupRoutes() {
-	s.router.Use(middleware.AuthMiddleware(s.database))
-
 	// Static files
 	s.router.StaticFile("/", "./static/index.html")
 	s.router.StaticFile("/favicon.ico", "./static/favicon.ico")
@@ -86,7 +84,7 @@ func (s *Server) setupRoutes() {
 	// WebSocket
 	s.router.GET("/ws", s.handleWebSocket)
 
-	// API V1 (External LLM Access)
+	// API V1 (External LLM Access) - Secured with AuthMiddleware
 	v1 := s.router.Group("/v1")
 	v1.Use(middleware.AuthMiddleware(s.database))
 	{