feat(auth): harden sessions + HA Ingress support

- backend: settings SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH,
  require_session uses secrets.compare_digest and respects trusted-network
  opt-in, main.py adds require_family_session middleware gating all /api/
  routes except auth/admin/email-vote-token paths
- docker-compose: pass SESSION_COOKIE_SECURE + TRUSTED_NETWORK_AUTO_AUTH
  through to backend + scheduler (fixes env-file changes not reaching runtime)
- frontend: Ingress path-prefix support (APP_BASE_PATH, BrowserRouter basename,
  vite base './'), Login redirect honors APP_BASE_PATH
- nginx: no-cache headers on root + /assets/
- docs: Home Assistant Ingress install/troubleshooting + plan file
- tests: test_auth expects 401 on no-session GET

Defaults: SESSION_COOKIE_SECURE=false, TRUSTED_NETWORK_AUTO_AUTH=true
(HA is the auth boundary; MealPlanner must not be port-forwarded directly).

backend/app/api/auth.py

@@ -53,7 +53,7 @@ def login(payload: LoginRequest, db: Session = Depends(get_db)):
         value=cookie_value,
         max_age=SESSION_MAX_AGE,
         httponly=True,
-        secure=True,
+        secure=settings.SESSION_COOKIE_SECURE,
         samesite="lax",
         path="/",
     )

backend/app/config.py

@@ -29,6 +29,8 @@ class Settings(BaseSettings):
     # Auth (R1-B+D)
     ADMIN_TOKEN: str = ""
     SESSION_PASSWORD: str = ""
+    SESSION_COOKIE_SECURE: bool = True
+    TRUSTED_NETWORK_AUTO_AUTH: bool = False
     ADMIN_EMAIL: str = ""
     APP_BASE_URL: str = "http://localhost"
 

backend/app/main.py

@@ -1,9 +1,11 @@
-from fastapi import FastAPI, Depends
+from fastapi import FastAPI, Depends, HTTPException, Request
+from fastapi.responses import JSONResponse
 from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
 from sqlalchemy import text
 from app.database import get_db
 from app.config import settings
+from app.security import require_session
 import logging
 
 logging.basicConfig(level=settings.LOG_LEVEL)
@@ -19,6 +21,31 @@ app = FastAPI(
 app.mount("/static", StaticFiles(directory="static"), name="static")
 
 
+def _requires_session(path: str, method: str) -> bool:
+    if method == "OPTIONS" or not path.startswith("/api/"):
+        return False
+    if path.startswith("/api/auth/") or path.startswith("/api/admin/"):
+        return False
+    # Email approval links carry their own signed, single-use token.
+    if path.startswith("/api/meals/vote/"):
+        return False
+    return True
+
+
+@app.middleware("http")
+async def require_family_session(request: Request, call_next):
+    if _requires_session(request.url.path, request.method):
+        try:
+            require_session(request)
+        except HTTPException as exc:
+            return JSONResponse(
+                status_code=exc.status_code,
+                content={"detail": exc.detail},
+                headers=getattr(exc, "headers", None),
+            )
+    return await call_next(request)
+
+
 @app.get("/health")
 def health_check(db: Session = Depends(get_db)):
     return {"status": "ok"}

backend/app/security.py

@@ -1,17 +1,6 @@
-"""
-Auth dependencies for the MealPlanner backend.
+"""Auth dependencies for the MealPlanner backend."""
 
-Two flavors:
-- ``require_admin`` — bearer token for ``/api/admin/*`` routes; token compared
-  to ``settings.ADMIN_TOKEN`` (must be set in env).
-- ``require_session`` — auto-returns the first family_profile_id (no login
-  required). This app runs on a private home network so auth is disabled
-  for family-facing routes. Kept as a dependency so admin/token endpoints
-  can be re-enabled later by restoring cookie logic.
-
-The per-voter approval-token flow on meal items is intentionally NOT covered
-here — it has its own short-lived single-use tokens elsewhere.
-"""
+import secrets
 
 from fastapi import HTTPException, Request, status
 from itsdangerous import TimestampSigner
@@ -35,7 +24,7 @@ def require_admin(request: Request) -> None:
             detail="Admin auth not configured",
         )
     auth = request.headers.get(bearer_header, "")
-    if not auth.startswith("Bearer ") or auth[7:] != expected:
+    if not auth.startswith("Bearer ") or not secrets.compare_digest(auth[7:], expected):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid admin token",
@@ -52,13 +41,7 @@ def issue_session(family_profile_id: str) -> str:
 
 
 def require_session(request: Request) -> str:
-    """Auto-authenticate: return the first family_profile_id from the DB.
-
-    No cookie or password needed — this app runs on a private home network.
-    If no FamilyProfile exists yet, return \"bootstrap\" so the app can
-    initialise itself on first run.
-    """
-    # 1. Try to read the signed cookie (backward-compat with existing sessions)
+    """Require a signed session cookie, with explicit LAN auto-auth opt-in."""
     raw = request.cookies.get(SESSION_COOKIE)
     if raw:
         try:
@@ -66,13 +49,24 @@ def require_session(request: Request) -> str:
                 _signer().unsign(raw.encode(), max_age=SESSION_MAX_AGE).decode()
             )
         except Exception:
-            pass  # fall through to auto-auth
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid or expired session",
+            )
 
-    # 2. Auto-auth: grab the first family profile from the DB
-    db = next(get_db())
-    profile = db.query(FamilyProfile).first()
-    if profile:
-        return str(profile.id)
+    if not settings.TRUSTED_NETWORK_AUTO_AUTH:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Session required",
+        )
+
+    db_gen = get_db()
+    db = next(db_gen)
+    try:
+        profile = db.query(FamilyProfile).first()
+        if profile:
+            return str(profile.id)
+    finally:
+        db_gen.close()
 
-    # 3. Bootstrap hatch — no profile yet, return a sentinel value
     return "bootstrap"

backend/tests/test_auth.py

@@ -19,6 +19,7 @@ import pytest
 os.environ.setdefault("ADMIN_TOKEN", "test-admin-token")
 os.environ.setdefault("SESSION_PASSWORD", "test-family-password")
 os.environ.setdefault("SECRET_KEY", "test-secret-key-do-not-use-in-prod")
+os.environ.setdefault("SESSION_COOKIE_SECURE", "false")
 
 
 @pytest.fixture(autouse=True)
@@ -27,6 +28,7 @@ def _reload_settings(monkeypatch):
     monkeypatch.setenv("ADMIN_TOKEN", "test-admin-token")
     monkeypatch.setenv("SESSION_PASSWORD", "test-family-password")
     monkeypatch.setenv("SECRET_KEY", "test-secret-key-do-not-use-in-prod")
+    monkeypatch.setenv("SESSION_COOKIE_SECURE", "false")
     # Re-instantiate the singleton so dependents pick up env.
     from app import config as app_config
 
@@ -76,11 +78,10 @@ def test_session_required_for_mutation(client):
 
 
 @pytest.mark.requires_postgres
-def test_session_open_for_reads(client):
-    """GET /api/profile is NOT auth-gated (reads stay open)."""
+def test_session_required_for_reads(client):
+    """GET /api/profile requires a session for non-LAN exposure."""
     r = client.get("/api/profile")
-    # Either 200 (profile exists) or 404 (no profile yet) — never 401.
-    assert r.status_code in (200, 404), r.text
+    assert r.status_code == 401, r.text
 
 
 # ---------------------------------------------------------------------------