Giorgio Gilestro
480fd311c5
Replaces the static bearer-token gate with a real auth boundary. The existing CASSANDRA_TOKEN path is retained as an admin / scripting escape hatch — kept compatible by aliasing require_token to require_auth. - New users table (migration 0007): email, argon2 password_hash, tier, email_verified (declared but not enforced until phase E), settings_json for the tone/analysis/anchor knobs we'll wire in phase D. - app/services/auth_service.py: argon2-cffi password hashing with timing- attack-resistant authenticate() (always runs a hash verify even on unknown-email to deny a username-enumeration oracle). - app/auth.py rewritten: require_auth returns a CurrentUser with either is_admin=True (bearer path) or a User object (session path). Failing requests get 303 → /login for HTML, 401 for API. Sessions signed with itsdangerous against CASSANDRA_SESSION_SECRET; 14-day TTL. - app/routers/auth.py: /login, /signup, /logout. Login form preserves the ?next=… param for redirect-after-login. Signup respects a new CASSANDRA_SIGNUP_ENABLED flag. - Standalone /login + /signup templates (no app chrome). base.html grows a user chip + logout link in the header (reads request.state.current_user). Phase A's main known limitations are documented in the plan: email verification is declared but not enforced; session revocation is best-effort (cookie-only, not DB-backed). Both land in phase E. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
42 lines
1.3 KiB
HTML
42 lines
1.3 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<title>Cassandra · Login</title>
|
|
<script>
|
|
(function() {
|
|
try { document.documentElement.dataset.theme = localStorage.getItem('cassandra.theme') || 'dark'; }
|
|
catch (e) { document.documentElement.dataset.theme = 'dark'; }
|
|
})();
|
|
</script>
|
|
<link rel="stylesheet" href="{{ url_for('static', path='/css/cassandra.css') }}" />
|
|
</head>
|
|
<body>
|
|
<div class="auth-shell">
|
|
<div class="auth-card">
|
|
<div class="auth-card__brand">Cassandra</div>
|
|
<div class="auth-card__hint">log in to access the dashboard</div>
|
|
|
|
{% if error %}<div class="auth-error">{{ error }}</div>{% endif %}
|
|
|
|
<form method="post" action="/login" autocomplete="on">
|
|
<input type="hidden" name="next" value="{{ next_path or '/' }}">
|
|
<label>Email
|
|
<input type="email" name="email" value="{{ email or '' }}" required autofocus>
|
|
</label>
|
|
<label>Password
|
|
<input type="password" name="password" required>
|
|
</label>
|
|
<button type="submit">Sign in</button>
|
|
</form>
|
|
|
|
{% if signup_enabled %}
|
|
<div class="auth-card__alt">
|
|
No account? <a href="/signup">Create one →</a>
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html>
|