Cookie login/logout, services-assent theme port, dead-code cleanup - #21
Merged
Conversation
- Add minimal auth flow over the existing API_TOKEN: POST /api/login sets an HttpOnly session cookie (rate-limited, constant-time compare), POST /api/logout clears it, GET /api/session reports state; the auth middleware now accepts bearer token or cookie. Frontend gains a /login page, a session-gated app layout, 401 redirects, and a Log Out menu item. - Port the services-assent look: oklch hue-245 neutral palette, Inter Variable body font, sidebar on its own surface with no borders so the header divider starts at the content column (no nav/header border cross). - Delete dead code: unreachable deployments components module, no-op authHeaders/withAccessToken stubs, orphaned global searchQuery state and its five dead filter sites, redundant sidebar_state cookie write. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Proper logout (and the login it required)
There was no session to log out of — auth was a static bearer token the SPA never sent, and the old logout button had been deleted. This adds the minimal real flow on top of the existing
API_TOKEN:POST /api/loginexchanges the token for an HttpOnlySameSite=Laxcookie (constant-time compare, 20/min rate limit);POST /api/logoutclears it;GET /api/sessionreports auth state.requireAuthmiddleware now accepts bearer header or the session cookie. No users table, no session store — the cookie stores the token itself (marked with aponytail:comment; switch to signed session IDs if per-session revocation is ever needed)./loginpage, a pathless session-gated layout route around the app shell, 401s redirect to/login, and Log Out is back in the account menu.AUTH_DISABLED=true(dev default) bypasses the gate.Theme + layout (services-assent port)
#f9f9fblight /#141413dark) with no borders, and the header divider starts at the content column.Dead-code cleanup (net −270 lines)
features/deployments/components.tsx(+test, 387 lines).authHeaders()/withAccessToken()stubs.searchQuerystore state — its input was removed in July, so five routes filtered on a permanently empty string.sidebar_statecookie write.Reviewer notes
web/src/router.tsxrestructures routes under a pathlessapplayout; page routes are otherwise unchanged./applications,/registries,/proxyremain reachable only by URL (no nav entry) — left as-is, flagging for a product decision.go test ./..., vitest 108/108, tsc, eslint (0 errors), production build, plus a live end-to-end check (login → shell → logout → gate redirect) in light and dark themes.🤖 Generated with Claude Code