enforce purgatory

Overlord-Server/src/server/routes/enrollment-routes.ts

@@ -1,5 +1,5 @@
 import { authenticateRequest } from "../../auth";
-import { getConfig, updateEnrollmentConfig } from "../../config";
+import { getConfig } from "../../config";
 import {
   getPendingClients,
   getEnrollmentStats,
@@ -49,37 +49,6 @@ export async function handleEnrollmentRoutes(
     });
   }
 
-  // PUT /api/enrollment/settings
-  if (req.method === "PUT" && url.pathname === "/api/enrollment/settings") {
-    const user = await authenticateRequest(req);
-    if (!user) return new Response("Unauthorized", { status: 401 });
-    if (user.role !== "admin") return new Response("Forbidden", { status: 403 });
-
-    let body: any;
-    try {
-      body = await req.json();
-    } catch {
-      return Response.json({ error: "Invalid JSON" }, { status: 400 });
-    }
-
-    if (typeof body?.requireApproval !== "boolean") {
-      return Response.json({ error: "requireApproval must be a boolean" }, { status: 400 });
-    }
-
-    await updateEnrollmentConfig({ requireApproval: body.requireApproval });
-
-    logAudit({
-      timestamp: Date.now(),
-      username: user.username,
-      ip: "server",
-      action: AuditAction.ENROLLMENT_SETTINGS,
-      success: true,
-      details: JSON.stringify({ enrollment: { requireApproval: body.requireApproval } }),
-    });
-
-    return Response.json({ ok: true, requireApproval: body.requireApproval });
-  }
-
   // POST /api/enrollment/:id/approve
   const approveMatch = url.pathname.match(/^\/api\/enrollment\/([^/]+)\/approve$/);
   if (req.method === "POST" && approveMatch) {

Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts

@@ -4,7 +4,6 @@ import geoip from "geoip-lite";
 import { logAudit, AuditAction } from "../../auditLog";
 import * as clientManager from "../../clientManager";
 import { clientExists, setOnlineState, upsertClientRow, getClientEnrollmentStatus, setClientEnrollmentStatus, lookupClientByPublicKey, getClientPublicKeyById } from "../../db";
-import { getConfig } from "../../config";
 import { logger } from "../../logger";
 import { metrics } from "../../metrics";
 import { decodeMessage, encodeMessage, type WireMessage } from "../../protocol";
@@ -250,8 +249,6 @@ export async function handleWebSocketMessage(
         ws.data.enrollmentNonce = undefined;
 
         const keyFingerprint = computeKeyFingerprint(publicKey);
-        const config = getConfig();
-        const requireApproval = config.enrollment?.requireApproval ?? true;
 
         const existing = lookupClientByPublicKey(publicKey);
         let enrollmentStatus: string;
@@ -260,7 +257,7 @@ export async function handleWebSocketMessage(
           enrollmentStatus = existing.enrollmentStatus;
           ws.data.clientId = existing.id;
         } else {
-          enrollmentStatus = requireApproval ? "pending" : "approved";
+          enrollmentStatus = "pending";
 
           const existingPk = getClientPublicKeyById(ws.data.clientId);
           if (existingPk && existingPk !== publicKey) {