Giorgio Gilestro
480fd311c5
Replaces the static bearer-token gate with a real auth boundary. The existing CASSANDRA_TOKEN path is retained as an admin / scripting escape hatch — kept compatible by aliasing require_token to require_auth. - New users table (migration 0007): email, argon2 password_hash, tier, email_verified (declared but not enforced until phase E), settings_json for the tone/analysis/anchor knobs we'll wire in phase D. - app/services/auth_service.py: argon2-cffi password hashing with timing- attack-resistant authenticate() (always runs a hash verify even on unknown-email to deny a username-enumeration oracle). - app/auth.py rewritten: require_auth returns a CurrentUser with either is_admin=True (bearer path) or a User object (session path). Failing requests get 303 → /login for HTML, 401 for API. Sessions signed with itsdangerous against CASSANDRA_SESSION_SECRET; 14-day TTL. - app/routers/auth.py: /login, /signup, /logout. Login form preserves the ?next=… param for redirect-after-login. Signup respects a new CASSANDRA_SIGNUP_ENABLED flag. - Standalone /login + /signup templates (no app chrome). base.html grows a user chip + logout link in the header (reads request.state.current_user). Phase A's main known limitations are documented in the plan: email verification is declared but not enforced; session revocation is best-effort (cookie-only, not DB-backed). Both land in phase E. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
46 lines
1 KiB
TOML
46 lines
1 KiB
TOML
[project]
|
|
name = "cassandra"
|
|
version = "0.1.0"
|
|
description = "Containerised macro-strategy dashboard — market data, news, portfolios, AI daily log."
|
|
requires-python = ">=3.13"
|
|
dependencies = [
|
|
"fastapi>=0.115",
|
|
"uvicorn[standard]>=0.32",
|
|
"jinja2>=3.1",
|
|
"python-multipart>=0.0.12",
|
|
"sqlalchemy[asyncio]>=2.0.36",
|
|
"aiomysql>=0.2.0",
|
|
"alembic>=1.14",
|
|
"pydantic>=2.9",
|
|
"pydantic-settings>=2.6",
|
|
"httpx>=0.28",
|
|
"apscheduler>=3.10",
|
|
"tenacity>=9.0",
|
|
"structlog>=24.4",
|
|
"argon2-cffi>=23.1",
|
|
"itsdangerous>=2.2",
|
|
"email-validator>=2.2",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = [
|
|
"pytest>=8.3",
|
|
"pytest-asyncio>=0.24",
|
|
"pytest-httpx>=0.34",
|
|
"ruff>=0.7",
|
|
]
|
|
|
|
[tool.pytest.ini_options]
|
|
asyncio_mode = "auto"
|
|
testpaths = ["tests"]
|
|
|
|
[tool.ruff]
|
|
line-length = 100
|
|
target-version = "py313"
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=68"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[tool.setuptools]
|
|
packages = ["app", "app.services", "app.jobs", "app.routers"]
|