Require login for /app/, with a long sliding session so you log in
once per device and effectively stay in.
- AppLoginRequiredMiddleware gates only /app/; /api/ keeps DRF token
auth and /admin/ keeps its own login (a blanket LoginRequired would
break token requests, whose user isn't resolved until the view runs).
- Login page (styled to the dark palette) via django.contrib.auth.urls;
logout control in the nav.
- Session: ~1 year cookie, sliding (saved every request), survives
browser close.
- Dropped every @csrf_exempt now that a real session + CSRF token are
in place (HTMX already sends X-CSRFToken).
- SECRET_KEY and DEBUG now read from the environment (prod-safe
defaults); systemd loads an optional /var/lib/food/.env.
- Tests authenticate, plus new coverage: /app/ redirects when logged
out, login grants access, /api/ is not caught by the app gate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace requirements.txt with pyproject.toml (direct deps only; uv
resolves the rest into uv.lock). Point the systemd unit at the
uv-managed .venv, and gitignore it.
Run `uv lock` to generate the lockfile and commit it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Track presence (In/Low/Out) as the primary signal instead of exact
quantities; quantity becomes an optional integer, unit optional too
(migration 0003 backfills state from quantity: 0 -> out, else in).
- Pantry rebuilt as a phone-first card list: colored state rail,
segmented In/Low/Out switch (server-driven HTMX), greyed out-items,
live summary counts.
- Fast add: bottom add bar with type-ahead autocomplete, location
picker, and quick-add chips for things you've run out of.
- Per-item menu (move / set expiry / delete); expiry is now an
optional quiet pill, never required.
- New endpoints: pantry search + set-state; dropped the old
edit-expiry/cancel flow and its partial.
- Recipes matcher made presence-based (have-it beats have-enough);
state added to admin. Tests cover state, add/restock, search,
presence matching, and page rendering.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Research of current state, requirements for the web-first pivot
(pantry polish -> auth -> MCP), and the phased implementation plan.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
