tradein-mvp/backend/app/api/v1/me.py

@@ -78,7 +78,7 @@ async def me(
     if not x_authenticated_user:
         raise HTTPException(
             status_code=401,
-            detail="no authenticated user (Caddy basic_auth required)",
+            detail="no authenticated user (valid session required)",
         )
     try:
         return get_user_scope(x_authenticated_user)

tradein-mvp/backend/app/api/v1/trade_in.py

@@ -63,7 +63,7 @@ def _assert_estimate_access(created_by: str | None, x_authenticated_user: str |
     if not x_authenticated_user:
         raise HTTPException(
             status_code=401,
-            detail="no authenticated user (Caddy basic_auth required)",
+            detail="no authenticated user (valid session required)",
         )
 
     from app.core.auth import get_role
@@ -688,7 +688,7 @@ def estimate_history(
     if not x_authenticated_user:
         raise HTTPException(
             status_code=401,
-            detail="no authenticated user (Caddy basic_auth required)",
+            detail="no authenticated user (valid session required)",
         )
 
     from app.core.auth import get_role

tradein-mvp/backend/app/core/rbac.py

@@ -222,7 +222,7 @@ async def rbac_guard(
         if not username:
             return JSONResponse(
                 status_code=401,
-                content={"detail": "no authenticated user (Caddy basic_auth required)"},
+                content={"detail": "no authenticated user (valid session required)"},
             )
 
         # #2213 defense-in-depth: если общий секрет задан — запрос с X-Authenticated-User