From 975180740132d772a43fed6cbcf8f07213d39088 Mon Sep 17 00:00:00 2001
From: KingKDot <why_are_you_looking_at_this@stoppeeping.com>
Date: Thu, 26 Mar 2026 15:28:49 -0500
Subject: [PATCH] enforce purgatory

---
 Overlord-Server/public/assets/purgatory-ui.js | 28 ----------------
 Overlord-Server/public/purgatory.html         | 17 ----------
 .../src/server/routes/enrollment-routes.ts    | 33 +------------------
 .../routes/websocket-lifecycle-routes.ts      |  5 +--
 4 files changed, 2 insertions(+), 81 deletions(-)

diff --git a/Overlord-Server/public/assets/purgatory-ui.js b/Overlord-Server/public/assets/purgatory-ui.js
index 64a591a..67cc216 100644
--- a/Overlord-Server/public/assets/purgatory-ui.js
+++ b/Overlord-Server/public/assets/purgatory-ui.js
@@ -1,7 +1,6 @@
 const body = document.getElementById("enrollment-body");
 const loadingRow = document.getElementById("enrollment-loading");
 const emptyEl = document.getElementById("enrollment-empty");
-const toggleEl = document.getElementById("require-approval-toggle");
 const selectAllEl = document.getElementById("select-all");
 const bulkApproveBtn = document.getElementById("bulk-approve-btn");
 const bulkDenyBtn = document.getElementById("bulk-deny-btn");
@@ -64,13 +63,6 @@ async function loadStats() {
   } catch {}
 }
 
-async function loadSettings() {
-  try {
-    const s = await api("/api/enrollment/settings");
-    toggleEl.checked = s.requireApproval;
-  } catch {}
-}
-
 async function loadClients() {
   loadingRow.classList.remove("hidden");
   emptyEl.classList.add("hidden");
@@ -242,25 +234,6 @@ document.querySelectorAll(".enrollment-tab").forEach((tab) => {
   });
 });
 
-// ── Toggle require approval ────────────────────────────────────────
-toggleEl.addEventListener("change", async () => {
-  try {
-    await api("/api/enrollment/settings", {
-      method: "PUT",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ requireApproval: toggleEl.checked }),
-    });
-    if (window.showToast)
-      window.showToast(
-        toggleEl.checked ? "Approval required" : "Auto-approve enabled",
-        "success",
-      );
-  } catch (e) {
-    toggleEl.checked = !toggleEl.checked;
-    if (window.showToast) window.showToast(`Failed: ${e.message}`, "error");
-  }
-});
-
 // ── Table delegation ───────────────────────────────────────────────
 body.addEventListener("click", (e) => {
   const btn = e.target.closest("button");
@@ -434,7 +407,6 @@ confirmBanBtn.addEventListener("click", async () => {
 });
 
 // ── Init ───────────────────────────────────────────────────────────
-loadSettings();
 loadStats();
 loadClients();
 
diff --git a/Overlord-Server/public/purgatory.html b/Overlord-Server/public/purgatory.html
index 92d8fa0..81171a1 100644
--- a/Overlord-Server/public/purgatory.html
+++ b/Overlord-Server/public/purgatory.html
@@ -40,23 +40,6 @@
           </div>
         </div>
 
-        <!-- Settings Card -->
-        <div class="mb-6 bg-slate-900/60 border border-slate-800 rounded-xl p-5">
-          <div class="flex items-center justify-between">
-            <div>
-              <h3 class="font-semibold text-slate-100">Approval Mode</h3>
-              <p class="text-sm text-slate-400">
-                When enabled, new clients must be approved before connecting.
-                When disabled, clients auto-approve on first connection.
-              </p>
-            </div>
-            <label class="relative inline-flex items-center cursor-pointer">
-              <input type="checkbox" id="require-approval-toggle" class="sr-only peer" />
-              <div class="w-11 h-6 bg-slate-700 peer-focus:ring-2 peer-focus:ring-sky-500 rounded-full peer peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-slate-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-amber-500"></div>
-            </label>
-          </div>
-        </div>
-
         <!-- Filter Tabs -->
         <div class="mb-4 flex items-center gap-2 flex-wrap">
           <button data-filter="pending"
diff --git a/Overlord-Server/src/server/routes/enrollment-routes.ts b/Overlord-Server/src/server/routes/enrollment-routes.ts
index 79f5e57..d520725 100644
--- a/Overlord-Server/src/server/routes/enrollment-routes.ts
+++ b/Overlord-Server/src/server/routes/enrollment-routes.ts
@@ -1,5 +1,5 @@
 import { authenticateRequest } from "../../auth";
-import { getConfig, updateEnrollmentConfig } from "../../config";
+import { getConfig } from "../../config";
 import {
   getPendingClients,
   getEnrollmentStats,
@@ -49,37 +49,6 @@ export async function handleEnrollmentRoutes(
     });
   }
 
-  // PUT /api/enrollment/settings
-  if (req.method === "PUT" && url.pathname === "/api/enrollment/settings") {
-    const user = await authenticateRequest(req);
-    if (!user) return new Response("Unauthorized", { status: 401 });
-    if (user.role !== "admin") return new Response("Forbidden", { status: 403 });
-
-    let body: any;
-    try {
-      body = await req.json();
-    } catch {
-      return Response.json({ error: "Invalid JSON" }, { status: 400 });
-    }
-
-    if (typeof body?.requireApproval !== "boolean") {
-      return Response.json({ error: "requireApproval must be a boolean" }, { status: 400 });
-    }
-
-    await updateEnrollmentConfig({ requireApproval: body.requireApproval });
-
-    logAudit({
-      timestamp: Date.now(),
-      username: user.username,
-      ip: "server",
-      action: AuditAction.ENROLLMENT_SETTINGS,
-      success: true,
-      details: JSON.stringify({ enrollment: { requireApproval: body.requireApproval } }),
-    });
-
-    return Response.json({ ok: true, requireApproval: body.requireApproval });
-  }
-
   // POST /api/enrollment/:id/approve
   const approveMatch = url.pathname.match(/^\/api\/enrollment\/([^/]+)\/approve$/);
   if (req.method === "POST" && approveMatch) {
diff --git a/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts b/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
index a3af11b..fbce719 100644
--- a/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
+++ b/Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
@@ -4,7 +4,6 @@ import geoip from "geoip-lite";
 import { logAudit, AuditAction } from "../../auditLog";
 import * as clientManager from "../../clientManager";
 import { clientExists, setOnlineState, upsertClientRow, getClientEnrollmentStatus, setClientEnrollmentStatus, lookupClientByPublicKey, getClientPublicKeyById } from "../../db";
-import { getConfig } from "../../config";
 import { logger } from "../../logger";
 import { metrics } from "../../metrics";
 import { decodeMessage, encodeMessage, type WireMessage } from "../../protocol";
@@ -250,8 +249,6 @@ export async function handleWebSocketMessage(
         ws.data.enrollmentNonce = undefined;
 
         const keyFingerprint = computeKeyFingerprint(publicKey);
-        const config = getConfig();
-        const requireApproval = config.enrollment?.requireApproval ?? true;
 
         const existing = lookupClientByPublicKey(publicKey);
         let enrollmentStatus: string;
@@ -260,7 +257,7 @@ export async function handleWebSocketMessage(
           enrollmentStatus = existing.enrollmentStatus;
           ws.data.clientId = existing.id;
         } else {
-          enrollmentStatus = requireApproval ? "pending" : "approved";
+          enrollmentStatus = "pending";
 
           const existingPk = getClientPublicKeyById(ws.data.clientId);
           if (existingPk && existingPk !== publicKey) {