8c6992035f
The dashboard had one shared password and no concept of a user. This adds real accounts: a username field on the login page, per-user credentials, and the signed-in user recorded on the session, which is the groundwork for per-user permissions later. Credentials are salted pbkdf2 hashes in settings.json's `users` map. Three deliberate choices there: - settings.json rather than an env var, because a pbkdf2 hash contains '$' and docker compose interpolates that when it reads .env. It's also already the bind-mounted file that survives `up -d --build`. - pbkdf2 rather than Werkzeug's default scrypt, which needs a hashlib built against OpenSSL — the macOS system Python has no hashlib.scrypt and would raise at hash time. - load_users() re-reads the file per check, so adding a user or changing a password is live in every gunicorn worker with no restart. The old _runtime_password was per-worker and only ever half-applied. Multi-user activates only once an account exists. Until then the original LOGIN_PASSWORD path is used unchanged and the username field is hidden, so deploying this can't lock the existing install out. manage_users.py prompts for passwords via getpass — never echoed, never a CLI argument — and only ever writes hashes; it refuses to remove the last account, which would silently drop the dashboard back to the shared password. Two fixes carried along: login no longer requires the LOGIN_PASSWORD env var specifically, so a settings.json-only password works instead of locking you out; and the legacy comparison now uses hmac.compare_digest, which the old docstring claimed but '==' didn't provide. Also gitignores settings.json and data/ — they hold API keys and now password hashes, were excluded from the deploy rsync but not from git. Verified: legacy fallback still signs in with no accounts configured; a 9-case credential matrix (right/wrong user x right/wrong password, plus the retired shared password); per-user change-password scoped to the signed-in account and live without restart; and the add/passwd/remove guards. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
86 lines
1.9 KiB
CSS
86 lines
1.9 KiB
CSS
/* Login page — tokens and base reset come from base.css */
|
|
|
|
/* Centre the card in the viewport (overrides base.css body). */
|
|
body {
|
|
min-height: 100vh;
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
padding: 1.5rem;
|
|
}
|
|
|
|
.wrap { width: 100%; max-width: 360px; }
|
|
|
|
.brand {
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
gap: 0.6rem;
|
|
margin-bottom: 1.75rem;
|
|
}
|
|
.brand h1 {
|
|
margin: 0;
|
|
font-size: var(--fs-lg);
|
|
font-weight: 600;
|
|
letter-spacing: -0.01em;
|
|
}
|
|
|
|
.card {
|
|
background: var(--surface);
|
|
border: 1px solid var(--border);
|
|
border-radius: var(--radius);
|
|
padding: 1.5rem;
|
|
}
|
|
|
|
label {
|
|
display: block;
|
|
font-size: var(--fs-xs);
|
|
font-weight: 600;
|
|
color: var(--text-2);
|
|
margin-bottom: 0.4rem;
|
|
}
|
|
input {
|
|
width: 100%;
|
|
min-height: var(--tap);
|
|
padding: 0 0.85rem;
|
|
background: var(--surface-2);
|
|
border: 1px solid var(--border);
|
|
border-radius: var(--radius-sm);
|
|
color: var(--text);
|
|
font-family: inherit;
|
|
font-size: 16px; /* prevents iOS zoom on focus */
|
|
outline: none;
|
|
transition: border-color 0.2s;
|
|
}
|
|
input:focus { border-color: var(--accent); }
|
|
input::placeholder { color: var(--text-3); }
|
|
/* Second field in a stacked pair (username above password) needs the gap
|
|
the single-field form never had. */
|
|
label.stacked { margin-top: 1rem; }
|
|
|
|
.error-msg {
|
|
background: var(--surface-2);
|
|
border: 1px solid var(--border);
|
|
border-left: 3px solid var(--danger);
|
|
border-radius: var(--radius-sm);
|
|
padding: 0.7rem 0.85rem;
|
|
color: var(--text-2);
|
|
font-size: var(--fs-sm);
|
|
margin-bottom: 1rem;
|
|
}
|
|
|
|
button {
|
|
width: 100%;
|
|
min-height: var(--tap);
|
|
margin-top: 1rem;
|
|
background: var(--accent);
|
|
color: var(--bg);
|
|
border: none;
|
|
border-radius: var(--radius-sm);
|
|
font-family: inherit;
|
|
font-size: var(--fs-sm);
|
|
font-weight: 600;
|
|
cursor: pointer;
|
|
transition: opacity 0.15s;
|
|
}
|
|
button:hover { opacity: 0.88; }
|