bypass profile select

auth.md

@@ -143,7 +143,9 @@ Behavior:
 
 - requests with `Host: 10.11.1.11:8090` or `Host: 10.11.1.11` use the built-in default admin user;
 - requests through the reverse proxy still require the configured auth provider;
-- profile permissions are ignored for bypassed direct-IP requests because they run as the default admin user.
+- profile permissions are ignored for bypassed direct-IP requests because they run as the default admin user;
+- when no active profile is saved for the bypass user, pyTorrent opens the profile picker instead of silently selecting the first profile;
+- after selecting a profile, the choice is saved in the default user's preferences and reused on the next direct-IP visit.
 
 Do not add public domains to this list.
 

pytorrent/services/preferences.py

@@ -118,6 +118,10 @@ def active_profile(user_id: int | None = None):
             if row:
                 return row
         profiles = list_profiles(user_id)
+        # Note: Trusted auth-bypass access must choose a profile explicitly on first entry,
+        # instead of silently reusing the first configured profile.
+        if auth.auth_bypassed_request() and profiles:
+            return None
         return profiles[0] if profiles else None
 
 

pytorrent/templates/index.html

@@ -145,6 +145,10 @@
         </select>
         <div class="form-text">Changing rTorrent reloads the live torrent snapshot.</div>
       </div>
+      <div class="modal-footer">
+        <button class="btn btn-sm btn-outline-secondary" data-bs-dismiss="modal" type="button">Cancel</button>
+        <button id="profilePickerUseBtn" class="btn btn-sm btn-primary" type="button"><i class="fa-solid fa-plug-circle-check"></i> Use selected</button>
+      </div>
     </div>
   </div>
 </div>