Deprecate no-user mode

New Feature / Enhancement

Problem

Parse Dashboard can be started without configuring any users. In this mode, the dashboard is accessible without authentication. While the /parse-dashboard-config.json endpoint blocks remote access in this mode with the message "Configure a user to access Parse Dashboard remotely", other endpoints such as /apps/:appId/agent do not apply the same restriction.

This inconsistency creates a defense-in-depth gap. The no-user mode inherently exposes sensitive configuration including the master key to any client without authentication. Rather than patching each new endpoint to handle this mode, the mode itself should be deprecated.

Proposal

• Deprecation warning: When no users are configured, log a prominent deprecation warning on startup indicating that no-user mode will be removed in a future major release.
• Consistent access control: Until removal, apply the same remote access restriction (localhost-only) that /parse-dashboard-config.json uses to all sensitive endpoints, including /apps/:appId/agent, done in https://github.com/parse-community/parse-dashboard/pull/3255.
• Removal: In a future major version, require at least one user to be configured. Remove no-user mode entirely.

Rationale

• No-user mode has no security boundary — the master key is served to any client without authentication.
• Every new endpoint must independently remember to handle the no-user case, which is error-prone.
• Requiring user configuration is a minimal operational burden and aligns with security best practices.
• This avoids recurring reports about endpoints being accessible without authentication in no-user mode.

Start by tracing startup handling for configured users and the existing localhost-only restriction on /parse-dashboard-config.json. Review the /apps/:appId/agent path and PR #3255, then identify the remaining no-user behavior. Done means a prominent deprecation warning and consistent interim access control are defined, with no-user removal scoped for a future major release.