n.siegfried
20afb0e565
Gate the suite behind a self-contained login (no external IdP): - User model with bcrypt-hashed passwords; admin/user roles - /api/auth endpoints: login, logout, me, change-password, and admin-only user management (list/create/delete/reset/enable) - Stateless JWT session in an HttpOnly, SameSite=Lax, auto-Secure cookie; middleware refuses every /api data route without a session - login.html + auth-guard.js: login page and per-page guard with a top-right "name / Admin / Sign out" pill - Admin Console now gated on admin role (passphrase gate removed) with a User administration card - manage_users.py CLI to bootstrap the first admin - Rebuilt help.js into a searchable, multi-topic help center - Local-dev convenience: app serves html/ so the site + API share one origin under uvicorn (inactive in the prod container) - Docs/env: AUTH_SECRET_KEY, requirements (bcrypt, PyJWT), README Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
10 lines
209 B
Plaintext
10 lines
209 B
Plaintext
fastapi>=0.110
|
|
uvicorn[standard]>=0.29
|
|
gunicorn>=21.2
|
|
sqlalchemy>=2.0
|
|
psycopg[binary]>=3.1
|
|
pydantic>=2.6
|
|
python-dotenv>=1.0
|
|
bcrypt>=4.1 # password hashing
|
|
PyJWT>=2.8 # signed session tokens
|