Tom FluxandClaude Opus 4.8
6bad2a2ad1
Require login for /app/, with a long sliding session so you log in once per device and effectively stay in. - AppLoginRequiredMiddleware gates only /app/; /api/ keeps DRF token auth and /admin/ keeps its own login (a blanket LoginRequired would break token requests, whose user isn't resolved until the view runs). - Login page (styled to the dark palette) via django.contrib.auth.urls; logout control in the nav. - Session: ~1 year cookie, sliding (saved every request), survives browser close. - Dropped every @csrf_exempt now that a real session + CSRF token are in place (HTMX already sends X-CSRFToken). - SECRET_KEY and DEBUG now read from the environment (prod-safe defaults); systemd loads an optional /var/lib/food/.env. - Tests authenticate, plus new coverage: /app/ redirects when logged out, login grants access, /api/ is not caught by the app gate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
22 lines
815 B
Python
22 lines
815 B
Python
from django.conf import settings
|
|
from django.contrib.auth.views import redirect_to_login
|
|
|
|
|
|
class AppLoginRequiredMiddleware:
|
|
"""Require a logged-in session for the /app/ HTMX UI.
|
|
|
|
Deliberately scoped to /app/ only:
|
|
- /api/ uses DRF token auth (its user isn't resolved until the view runs,
|
|
so a blanket login check here would wrongly reject valid tokens).
|
|
- /admin/ has its own login.
|
|
- the login page and /static/ must stay reachable while logged out.
|
|
"""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
if request.path.startswith("/app/") and not request.user.is_authenticated:
|
|
return redirect_to_login(request.get_full_path(), settings.LOGIN_URL)
|
|
return self.get_response(request)
|