Node-RED Admin API /flows Endpoint Permission Check Missing When adminAuth Disabled

Node-RED Admin API /flows Endpoint Permission Check

When the adminAuth setting is disabled, the /flows endpoint does not perform an explicit permission verification, allowing unauthenticated requests to read or modify flows. Deployments triggered through this endpoint may fail silently, and the log only shows a generic “Error: Failed to deploy flow” message without indicating whether the cause is missing authentication, a syntax error, or a runtime exception.

The unresolved decision is whether Node-RED should enforce an authorization check and log a distinct authentication‑failure signal even when adminAuth is turned off, or rely on external middleware to provide that visibility.

Should the admin API return a clear 401 Unauthorized response when adminAuth is disabled but no credentials are supplied? Should Node-RED log an authorization‑specific error that separates it from other deployment failures? Should administrators be required to enable adminAuth or configure additional middleware to obtain reliable deployment diagnostics?