Public Access
adminandClaude Opus 4.7
8e89f793d5
R1 stabilization: pytest harness with transactional db fixture, smoke + alembic + auth + scrape + approval + swiftly tests, github actions ci yaml. Bearer-token admin auth + signed-cookie session for family ui mutations. Async POST /api/admin/scrape (BackgroundTasks, returns 202). Path canonicalization (no /list, /planned suffixes). DATABASE_URL fail-fast on empty. R2 deferred-risk spikes: live lucky california fetch (R2-A), full email+per-voter approval click round trip with single-use enforcement (R2-B, console email backend, sendgrid stub). R3-0 phase 3 redesign: replaced playwright html scraper with requests based swiftly json api client. 17 categories, ~10k products per scrape, upsert by (source, external_id). 401 surfaces actionable token-refresh message via ScrapeLog.error_message. Pre-existing defects fixed: shopping_list.py syntax error blocking app import, MealPlan.votes orphan relationship, JSONB(astext=True) invalid kwarg, missing requests dep, calorie_target schema drift, every SQLEnum needed values_callable, 0001 had empty downgrade(), seed had duplicate ingredient rows. Migrations added: 0003 grocery_item.description, 0004 family_profile. calorie_target, 0005 grocery_item.external_id + source + composite index. Verified: 31/31 pytest green, alembic upgrade->downgrade->upgrade clean, frontend npm run build clean, live scrape 9,960 grocery_item rows in 36s. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
68 lines
2.1 KiB
Python
68 lines
2.1 KiB
Python
"""
|
|
Family-shared session login.
|
|
|
|
POST /api/auth/login — body ``{"password": "..."}`` — must match
|
|
``settings.SESSION_PASSWORD``. On success: signs the first FamilyProfile.id
|
|
and writes it as the ``mp_session`` cookie, returns 204.
|
|
|
|
POST /api/auth/logout — clears the cookie, returns 204.
|
|
|
|
The session is intentionally simple: a single shared family password gates
|
|
mutations behind nginx on the trusted network. No per-user auth.
|
|
"""
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Response, status
|
|
from pydantic import BaseModel
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.config import settings
|
|
from app.database import get_db
|
|
from app.models import FamilyProfile
|
|
from app.security import SESSION_COOKIE, SESSION_MAX_AGE, issue_session
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
password: str
|
|
|
|
|
|
@router.post("/login")
|
|
def login(payload: LoginRequest, db: Session = Depends(get_db)):
|
|
expected = settings.SESSION_PASSWORD
|
|
if not expected:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
|
|
detail="Session auth not configured",
|
|
)
|
|
if payload.password != expected:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid password"
|
|
)
|
|
|
|
profile = db.query(FamilyProfile).first()
|
|
# If no profile exists yet, sign a placeholder so the cookie still
|
|
# validates; the family-id will be re-issued the first time a profile
|
|
# is created. This avoids login being blocked on first-run.
|
|
family_id = str(profile.id) if profile else "bootstrap"
|
|
cookie_value = issue_session(family_id)
|
|
|
|
response = Response(status_code=status.HTTP_204_NO_CONTENT)
|
|
response.set_cookie(
|
|
key=SESSION_COOKIE,
|
|
value=cookie_value,
|
|
max_age=SESSION_MAX_AGE,
|
|
httponly=True,
|
|
secure=True,
|
|
samesite="lax",
|
|
path="/",
|
|
)
|
|
return response
|
|
|
|
|
|
@router.post("/logout")
|
|
def logout():
|
|
response = Response(status_code=status.HTTP_204_NO_CONTENT)
|
|
response.delete_cookie(key=SESSION_COOKIE, path="/")
|
|
return response
|