Automatic dev-bypass (accessing admin without setup)

[MA2153]

Currently, bypassing admin setup in dev mode requires visiting the /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin route.

Issue: Many developers miss this in the EmDash docs, ending up with a bunch of passkeys on their device. Besides, it is kind of annoying to have to visit a URL every time.

Suggestion:

• During dev mode, automatically apply the bypass. Developers expect this behavior.
• During preview mode, require setup as usual.

[ascorbic]

Yeah, I get that. It makes sense. I am wondering if there might be unintended effects though. Maybe configurable – on by default, but allow it to be disabled if for example you're testing your login providers, or want to test multiple users

[MA2153]

That sounds good. We can add a property in EmDashConfig to disable it.

[MA2153]

Does that mean we are not doing the preview thing? Keep the behavior the same across dev and preview, only source of truth is the EmDashConfig?

[ascorbic]

This should be dev only. We can't risk someone leaving it on by mistake.

[MA2153]

Sounds good.

[eba8]

I'll work on this 👋

[masonjames]

@eba8 this is approved and would be a useful PR. A good first cut would be configurable dev-only auto-bypass: on by default for astro dev, disabled for preview/prod, with an opt-out for people testing auth providers or multiple users. Keeping the existing manual bypass routes as-is and adding middleware/config tests should make it easy to review. Please link the PR back here when you open it.