[Bug]: Wrong configuration triggers setup-page and allows user/password override

[ralf31337]

🔍 Bug Summary

When a hostname of paperless cannot be resolved it redirects the user to the setup-page allowing admin password override even if it already exists.

📖 Description

isConfigured() fails on network/config errors (lines 250-328 in services/setupService.js):

• If the Paperless URL cannot be resolved, validateConfig() throws an error
• After retries, isConfigured() returns false
  Middleware redirects to setup (lines 177-178 in routes/setup.js):
  if (!isConfigured && (!process.env.PAPERLESS_AI_INITIAL_SETUP || process.env.PAPERLESS_AI_INITIAL_SETUP === 'no') && !req.path.startsWith('/setup')) { return res.redirect('/setup'); }

When isConfigured() is false, it redirects to /setup even if users already exist

🔄 Steps to Reproduce

1. Configure system
2. Change paperless hostname
3. Access Paperless-AI
4. You get redirected to /setup

✅ Expected Behavior

Access to /setup must always be with authentication, except if no user is configured.

❌ Actual Behavior

/setup is accessible without authentication

🏷️ Paperless-AI Version

3.0.9

📜 Docker Logs

n/a

📜 Paperless-ngx Logs

n/a

🖼️ Screenshots of your settings page

No response

🖥️ Desktop Environment

Other

💻 OS Version

not relevant

🌐 Browser

Firefox

🔢 Browser Version

No response

🌐 Mobile Browser

No response

📝 Additional Information

• I have checked existing issues and this is not a duplicate
• I have tried debugging this issue on my own
• I can provide a fix and submit a PR
• I am sure that this problem is affecting everyone, not only me
• I have provided all required information above

📌 Extra Notes

No response