From d92deeab514a52e7c3416baef78f8969ade951cc Mon Sep 17 00:00:00 2001 From: Tom Flux Date: Tue, 23 Jun 2026 20:37:48 +0100 Subject: Phase 2: session auth for the web UI Require login for /app/, with a long sliding session so you log in once per device and effectively stay in. - AppLoginRequiredMiddleware gates only /app/; /api/ keeps DRF token auth and /admin/ keeps its own login (a blanket LoginRequired would break token requests, whose user isn't resolved until the view runs). - Login page (styled to the dark palette) via django.contrib.auth.urls; logout control in the nav. - Session: ~1 year cookie, sliding (saved every request), survives browser close. - Dropped every @csrf_exempt now that a real session + CSRF token are in place (HTMX already sends X-CSRFToken). - SECRET_KEY and DEBUG now read from the environment (prod-safe defaults); systemd loads an optional /var/lib/food/.env. - Tests authenticate, plus new coverage: /app/ redirects when logged out, login grants access, /api/ is not caught by the app gate. Co-Authored-By: Claude Opus 4.8 --- deploy/food.service | 3 +++ 1 file changed, 3 insertions(+) (limited to 'deploy') diff --git a/deploy/food.service b/deploy/food.service index 1211bce..d9cade8 100644 --- a/deploy/food.service +++ b/deploy/food.service @@ -9,6 +9,9 @@ Group=openclaw WorkingDirectory=/var/lib/food Environment="PATH=/var/lib/food/.venv/bin:/usr/bin" Environment="DJANGO_SETTINGS_MODULE=food_project.settings" +# Secrets/config (DJANGO_SECRET_KEY, optional DJANGO_DEBUG) live here, not in git. +# The leading '-' makes it optional so the service still starts if absent. +EnvironmentFile=-/var/lib/food/.env ExecStart=/var/lib/food/.venv/bin/gunicorn food_project.wsgi:application \ --bind 127.0.0.1:8042 \ --workers 2 \ -- cgit v1.2.3