From 8c38808d1223c64b86e6d3572a8b933d91a224b6 Mon Sep 17 00:00:00 2001
From: Sebas <claude.these371@passmail.net>
Date: Wed, 24 Jun 2026 08:00:55 +0000
Subject: [PATCH] Stage 3: leeres DTRACK_PERMISSIONS = nicht gesetzt
 (Compose-sicher)

---
 crates/dtrack-http/src/gate.rs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/crates/dtrack-http/src/gate.rs b/crates/dtrack-http/src/gate.rs
index 71bb9c3..db06d28 100644
--- a/crates/dtrack-http/src/gate.rs
+++ b/crates/dtrack-http/src/gate.rs
@@ -27,9 +27,12 @@ pub enum Gate {
 
 impl Gate {
     /// `DTRACK_PERMISSIONS` (Policy-Datei) hat Vorrang, sonst flache Liste aus
-    /// `DTRACK_HTTP_TOKENS`.
+    /// `DTRACK_HTTP_TOKENS`. Ein leeres `DTRACK_PERMISSIONS` zaehlt als "nicht
+    /// gesetzt" (Compose reicht leere Variablen durch).
     pub fn from_env() -> anyhow::Result<Self> {
-        if let Ok(path) = std::env::var("DTRACK_PERMISSIONS") {
+        if let Ok(path) = std::env::var("DTRACK_PERMISSIONS")
+            && !path.trim().is_empty()
+        {
             let policy = Policy::load(&path)?;
             tracing::info!("RBAC aktiv: {} Client(s) aus {path}", policy.client_count());
             return Ok(Self::Rbac(Arc::new(policy)));