fixes: web

api/web_routes.py

@@ -1218,6 +1218,7 @@ async def get_episode_date_options(dependencies: dict, imdb_id: str, season: int
 
 def register_web_routes(app, dependencies):
     """Register all web API routes with FastAPI app"""
+    from fastapi import Request, Response
     
     # Dashboard and stats endpoints  
     @app.get("/api/dashboard")
@@ -1291,9 +1292,33 @@ def register_web_routes(app, dependencies):
     
     # Authentication endpoints (for web interface compatibility)
     @app.get("/api/auth/status")
-    async def api_auth_status():
-        return {"authenticated": False, "username": None}  # Simplified for now
+    async def api_auth_status(request: Request):
+        """Check authentication status"""
+        auth_enabled = dependencies.get("auth_enabled", False)
+        
+        if not auth_enabled:
+            return {"authenticated": True, "auth_enabled": False, "message": "Authentication disabled"}
+        
+        session_manager = dependencies.get("session_manager")
+        if not session_manager:
+            return {"authenticated": False, "auth_enabled": True, "message": "Session manager not available"}
+        
+        session_token = request.cookies.get("nfoguard_session")
+        if session_token:
+            username = session_manager.get_session_user(session_token)
+            if username:
+                return {"authenticated": True, "auth_enabled": True, "username": username}
+        
+        return {"authenticated": False, "auth_enabled": True, "message": "Not authenticated"}
     
     @app.post("/api/auth/logout")
-    async def api_auth_logout():
-        return {"status": "success", "message": "Logged out"}
+    async def api_auth_logout(request: Request, response: Response):
+        """Logout endpoint - clears session"""
+        session_manager = dependencies.get("session_manager")
+        if session_manager:
+            session_token = request.cookies.get("nfoguard_session")
+            if session_token:
+                session_manager.delete_session(session_token)
+        
+        response.delete_cookie("nfoguard_session")
+        return {"status": "logged_out", "message": "Session cleared"}