yunke

xinyouhe/yunke

Fork 0

Commit Graph

Author	SHA1	Message	Date
浅念	6880ff1b97	feat(auth): 登录页(用户名/密码换 API token)+ 前端全链路登录态后端: - POST /api/auth/login:admin 账密(Settings 默认 admin/admin123, ADMIN_USER/ADMIN_PASSWORD 可覆盖)换取共享 api_token,免 token 中间件 - 防爆破:同 IP 15min 窗口内 5 次失败锁 15min(429),成功登录清零 - 错误信息统一「用户名或密码错误」(防用户名枚举) - 测试 7 个新增(TDD),全量 500 绿前端: - LoginView + 路由守卫(未登录跳 /login,回跳 redirect) - axios 请求拦截器自动带 Bearer;401 清登录态回登录页 - 媒体直链统一 mediaUrl() 带 ?token=(img/audio 标签发不了 header), 替换 4 处裸拼;downloadBlob 手动带头 - isLoggedIn 按 key 存在判定 — 后端鉴权关闭时空 token 不锁死登录页 - MainLayout 侧栏底部退出登录 compose:两份编排透传 ADMIN_USER/ADMIN_PASSWORD(默认 admin/admin123) Co-Authored-By: Claude Code <noreply@anthropic.com>	2026-09-03 15:03:20 +08:00
浅念	83b1aeb97c	feat: simple shared-token api auth Adds a shared-token auth dependency for the viewing API (Task 2.9). Trust model: when API_TOKEN is empty (the default) auth is disabled — we trust the network boundary (local/intranet tool). When set, every request must present the token via `Authorization: Bearer <token>` or `?token=<token>`, else 401. `/api/health` is exempt so liveness probes work without the token. - app/config.py: add `api_token: str = ""` to Settings. - app/api/auth.py: `require_auth` dependency (secrets.compare_digest, reads get_settings() per-request so token rotation via cache_clear() works). - app/api/main.py: apply the dependency globally; document the trust model. - .env.example: document API_TOKEN. - tests/test_api_auth.py: 8 tests covering disabled/correct/missing/wrong/ malformed-header/query-param/health-exempt paths. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-01 14:30:28 +08:00

Author

SHA1

Message

Date

浅念

6880ff1b97

feat(auth): 登录页(用户名/密码换 API token)+ 前端全链路登录态

后端:
- POST /api/auth/login:admin 账密(Settings 默认 admin/admin123,
  ADMIN_USER/ADMIN_PASSWORD 可覆盖)换取共享 api_token,免 token 中间件
- 防爆破:同 IP 15min 窗口内 5 次失败锁 15min(429),成功登录清零
- 错误信息统一「用户名或密码错误」(防用户名枚举)
- 测试 7 个新增(TDD),全量 500 绿

前端:
- LoginView + 路由守卫(未登录跳 /login,回跳 redirect)
- axios 请求拦截器自动带 Bearer;401 清登录态回登录页
- 媒体直链统一 mediaUrl() 带 ?token=(img/audio 标签发不了 header),
  替换 4 处裸拼;downloadBlob 手动带头
- isLoggedIn 按 key 存在判定 — 后端鉴权关闭时空 token 不锁死登录页
- MainLayout 侧栏底部退出登录

compose:两份编排透传 ADMIN_USER/ADMIN_PASSWORD(默认 admin/admin123)

Co-Authored-By: Claude Code <noreply@anthropic.com>

2026-09-03 15:03:20 +08:00

浅念

83b1aeb97c

feat: simple shared-token api auth

Adds a shared-token auth dependency for the viewing API (Task 2.9). Trust
model: when API_TOKEN is empty (the default) auth is disabled — we trust the
network boundary (local/intranet tool). When set, every request must present
the token via `Authorization: Bearer <token>` or `?token=<token>`, else 401.
`/api/health` is exempt so liveness probes work without the token.

- app/config.py: add `api_token: str = ""` to Settings.
- app/api/auth.py: `require_auth` dependency (secrets.compare_digest, reads
  get_settings() per-request so token rotation via cache_clear() works).
- app/api/main.py: apply the dependency globally; document the trust model.
- .env.example: document API_TOKEN.
- tests/test_api_auth.py: 8 tests covering disabled/correct/missing/wrong/
  malformed-header/query-param/health-exempt paths.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-08-01 14:30:28 +08:00

2 Commits