feat(auth): optional password login for the UI#1
Merged
Merged
Conversation
Add opt-in single-password authentication, off by default so existing open deployments are unchanged. Enable it by setting FT_AUTH_PASSWORD. Backend (internal/api/auth.go): - Session login: POST /api/login verifies the password (constant-time) and issues an HMAC-signed, HttpOnly, SameSite cookie (Secure over HTTPS, honoring X-Forwarded-Proto). Lifetime via FT_AUTH_SESSION_HOURS (default 7 days). - Per-IP login rate limiting (5 fails -> 5 min lockout) to resist brute force. - GET /api/auth status + POST /api/logout. - withAuth accepts either a session cookie or the existing FT_API_TOKEN bearer; gates the UI and /api/*, leaving /stream and player-compat routes open. - Gate the mutating TorrServer-compat actions (rem/set on /torrents, set on /settings) behind auth; add/get/drop/list and streaming stay open so players keep working. Frontend: - AuthGate resolves auth state on load, renders the Login screen when required, and drops back to login on a mid-session 401. - api client: authStatus/login/logout + global 401 handler. - Logout button in the toolbar; en/es strings. Docs: README env table, an Authentication subsection, security notes, and a docker-compose example. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012bj3G2zzqEaALFa8ufbkDJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qué hace
Añade autenticación opcional por contraseña para el frontend. Está desactivada por defecto (deployments abiertos siguen igual) y se activa con
FT_AUTH_PASSWORD.Backend
POST /api/loginvalida la contraseña (comparación en tiempo constante) y emite una cookie HttpOnly + SameSite firmada con HMAC (secreto aleatorio por arranque).Secureautomático en HTTPS (respetaX-Forwarded-Proto). Duración víaFT_AUTH_SESSION_HOURS(default 7 días).429+Retry-After).GET /api/auth(estado) yPOST /api/logout.withAuthacepta cookie de sesión O elFT_API_TOKENBearer existente. Protege la UI +/api/*; deja abierto/streamy compat.rem/seten/torrents,seten/settings);add/get/drop/listy streaming siguen abiertos → los reproductores (Kodi/Stremio/VLC) no se rompen.Frontend
AuthGateresuelve el estado al cargar, muestra la pantalla de Login cuando hace falta y vuelve a login ante un401a mitad de sesión.authStatus/login/logout+ manejo global de401.en/es.Docs
Tabla de env vars, subsección Authentication, notas de seguridad y ejemplo de
docker-compose.Verificación
go build+go vet+ tests en verde (incluyeauth_test.go: firma/expiración de token, lockout, cookie end-to-end).tsc+vite buildOK.Securesobre HTTPS,rem/set→401sin sesión y200con sesión, rate-limit →429.🤖 Generated with Claude Code