Calibre-web: OPDS downloads fail while using LDAP

[ground7]

The decorater line you removed is for checking if the current user has the access right to download books.By removing it, everybody can download books. From my point of view there are 2 possibilitys:
1) The user really has no download rights
2) there is something wrong in the code and the download_required function is called without active user (I had this one in the past, was a bit ugly)
Could you please verify no 1 and if this is not the case, please open a issue (link to your commit would be enough) I will try to check it within the next couple of days

_Originally posted by @OzzieIsaacs in https://github.com/janeczku/calibre-web/pull/1120#issuecomment-618809311_

Here’s the link to the removed decorator line

[OzzieIsaacs]

The user login for the opds feed wasn't working correct for ldap login, so the access rights where always checked for the Guest account. Should work now.
The fallback login isn't working with opds feed. This is something which look like hard to enable, so I will not do it. I'll make a note in the wiki regarding this.

[ground7]

It is working for me now in both Chunky and Marvin 3. Thanks!

Personally my fallback login is just a failsafe against ldap mishaps and isn't used as a way to access an opds feed. It's likely that this is the case for the vast majority of people who'd use ldap, so I don't think it's worth getting that scenario working either.

As an aside, something else I was able to do which isn't too big of a deal, but should probably be prevented, is I was able to have 0 admin accounts. It refreshed as soon as I saved it rather than having to reboot manually before the settings took effect, and there was no warning on having 0 admin accounts. I'm not sure if this is exclusive to ldap or not, but it might be a good idea to throw up a warning of some sort if there is no other account with admin privileges if you untick it on your current one.

I can make another issue for this if you'd like.

[OzzieIsaacs]

There is a check in admin.py line 837 to prevent this. I check if it‘s working, looks like it‘s not working

[OzzieIsaacs]

Found it, you couldn't delete the last user, but you could remove the admin role from him. It's now prevented.