phase: 11_admin_login
**Verified (final pass, phase 11 — all 7 tasks already in `complete/`)**
- Gate from the wire on a restarted dev server: `/system`→`303 /login?next=/system` (`/llm?range=1h`→`/login?next=/llm%3Frange%3D1h`), `/api/summary`+`/api/config`→`401 {"ok":false,…}`, `/api/health`→`200`; signed-in `GET` of all six pages `200`, `/login`→`303 /`.
- Auth flows on a throwaway server (`:8199`, `/tmp` DB — dev `auth.verifier` untouched): wrong pw `401`, `testpass` `200`, password change `200`, **old cookie `401` / new cookie `200`**, old pw `401` / new pw `200`, short new `422`, wrong current `403`, cookie write without CSRF `403`, logout `200`; 5 failures then `429 retry-after: 60`; `login-denied`/`password-changed`/`password-denied` events; `meta` = the two auth keys.
- Fail-closed boot (no seed, empty DB): **exit 3**, message names `DASH_ADMIN_PASSWORD`, `auth.verifier`, and the `DELETE FROM meta …` reset. `dev-server.sh status` + the Containerfile `HEALTHCHECK` python one-liner both `200`/exit 0 unauthenticated.
- Live payloads unchanged (phases 01–10 walk): `/api/summary` keys + 8 alerts + hosts 3/2 live; UPS `simulated:false` with charge/load/runtime severity; deskwork `nvme0n1` 51 °C/19 159 h/11 % wear; gateway `smartctl_available:false`; driveripper `unreachable` stub.
**Tests/lint (all green)**: `bash .agents/validate.sh` → exit 0 — `1140 passed, 11 skipped`, coverage `98.62%` (floor 94), ruff `All checks passed!`, pyright `0 errors`, `node --check` clean, repo hygiene clean. `uv run pytest -m live --live` → `8 passed, 3 failed`, all `driveripper: 10.1.0.126:9120 … ConnectError` (pre-existing, auth-free; probe confirms nothing listening).
**Completion criteria**: all met except the live-suite caveat above — installing the driveripper agent needs root on that host (no `ops` grant), so per the live-infra rule I made **no live change**; task 07's five screenshots (`auth-login/-rejected/-locked-out/-signed-in-overview/-settings.png`) remain the browser evidence, and the login/rotation/lockout flows were re-proved over HTTP this pass.
**Docs**: README — fixed "only place the CSRF token is published" (login/password responses mint one), added the undocumented `DASH_RELOAD` row, stated that Sign out ends only this browser's cookie. `AGENTS.md` — new known gap 8 (stateless logout cannot revoke a copied token), gap-4 dev-store sizes dated, fleet section notes `data/` is gitignored. `api.py` — same `status` docstring imprecision fixed. Verified the 4 `DASH_*` rows, reset command, seed-wins rule and invariant 12 against `app.py`/`config.py`.
**Deviations**: no dependency bump (`uv pip list --outdated` advisory: certifi/fastapi/starlette — phase added none); verification notes appended to `data/logs/NOTES-auth.md` §10.
**Next pending phase**: `12_nut_self_test_verdict`.
This commit is contained in:
@@ -0,0 +1,83 @@
|
||||
# Task 05 — The login page
|
||||
|
||||
**Phase:** `11_admin_login` · **Source:** operator request 2026-10-17 — "password protect this dashboard"
|
||||
**Story:** n/a
|
||||
|
||||
## Objective
|
||||
|
||||
A single-purpose page at `/login` that asks for the admin password, says honestly why it
|
||||
refused, and lands the operator on `/` (or the page they were heading to). Hand-rolled HTML +
|
||||
one small script, no CDN, dark/light parity with the dashboards.
|
||||
|
||||
## Work
|
||||
|
||||
1. `src/dashboards/web/pages/login.html` — modelled on the other four pages' `<head>`
|
||||
(`/static/dash.css`, the same inline SVG favicon, `data-theme="dark"` so `app.js` can flip
|
||||
it from `localStorage` before paint):
|
||||
- title `Homelab · sign in`; the `.masthead` brand link, but **no** `.tabs` nav — the tabs
|
||||
lead to pages that would bounce straight back here, and a nav of links that all redirect
|
||||
is a lie about what is available.
|
||||
- one `.card` in `main`: `<h1>Sign in</h1>`, a `.sub` line naming what this protects ("the
|
||||
fleet's system, engine and battery dashboards — including the UPS controls"), then a form:
|
||||
`<label for="admin-password">Admin password</label>` +
|
||||
`<input id="admin-password" type="password" autocomplete="current-password" required>` +
|
||||
`<button class="action" id="sign-in" type="submit">Sign in</button>`.
|
||||
- a `<p id="login-error" class="login-error" role="alert" hidden>` for refusals and
|
||||
`<p id="login-note" class="faint mono" hidden>` for the lockout countdown.
|
||||
- scripts: `/static/app.js` then `/static/page-login.js`, `defer`.
|
||||
- **no** username field: one admin, and a field that is always the same word teaches the
|
||||
operator that half the form is theatre (`auth.ADMIN_USER` is the server's business).
|
||||
2. `src/dashboards/web/static/page-login.js` — IIFE in the house style (see
|
||||
`page-index.js`), no framework:
|
||||
- `submit` handler → `POST /api/auth/login` with
|
||||
`Dash.fetchJSON` (it adds the JSON accept header and turns a non-2xx into a thrown
|
||||
`Error` with `status`/`body`); body `{password}`;
|
||||
- on success `location.assign(body.next || '/')`;
|
||||
- on `401` show `Wrong password.` and select the field's contents (fixing a typo without
|
||||
retyping is the whole UX of a login form);
|
||||
- on `429` show the `detail` plus the `Retry-After` seconds ticking down, and disable the
|
||||
button until it reaches 0 — a submit that will be refused should not look pressable;
|
||||
- on any other failure print the server's `detail` verbatim through the escape path the app
|
||||
already uses for text (`textContent`, never `innerHTML`);
|
||||
- honour `?next=` **only** if it starts with `/` and not `//` (the same rule the server
|
||||
enforces; a client-side copy is defence in depth, and the server's check is the one that
|
||||
counts);
|
||||
- if the browser already holds a valid session, `GET /api/auth/status` succeeds → redirect
|
||||
to `/` immediately (task 03 also does this server-side; this is what stops a flash of the
|
||||
form).
|
||||
3. `src/dashboards/web/static/dash.css`:
|
||||
- extend the existing `input[type="text"]` rule (line ~642) to
|
||||
`input[type="text"], input[type="password"]` — do not duplicate it;
|
||||
- add `.login-card { max-width: 26rem; margin: 3rem auto; }` and `.login-error { color:
|
||||
var(--fail); }`, `.login-card form { display: grid; gap: .6rem; }`, plus
|
||||
`.login-card label { font-size: 10.5px; text-transform: uppercase; letter-spacing: .06em;
|
||||
color: var(--text-faint); }` (the same caption vocabulary as `.hero .label`);
|
||||
- only existing `:root` tokens (`--fail`, `--text-faint`, `--accent`, …) —
|
||||
`tests/test_api.py` fails if a rule reaches for a token `:root` does not declare, and if a
|
||||
`.sev-*` family appears.
|
||||
4. Keep the invariant: nothing external. `tests/test_api.py` already asserts the pages load no
|
||||
foreign asset — extend that assertion to `/login` (same test, one more path).
|
||||
|
||||
## Testing & Quality
|
||||
|
||||
- `tests/test_api.py` (the served-HTML section) — `/login` is served anonymously with
|
||||
`HTTP/1.1 200`, contains `id="admin-password"`, `type="password"`,
|
||||
`autocomplete="current-password"`, `role="alert"`, and **no** `/system`-style `.tabs`; no
|
||||
`http://` or `https://` asset reference in the served bytes.
|
||||
- Orphan-`id` pin: every new `id` (`admin-password`, `sign-in`, `login-error`, `login-note`)
|
||||
must be referenced by `page-login.js` (or the CSS) — that test fails on a dead `id`, so name
|
||||
what you use and use what you name.
|
||||
- `node --check src/dashboards/web/static/page-login.js` (part of `validate.sh`).
|
||||
- Coverage: no new Python; the served-bytes assertions are the tests. Do not add a JS test
|
||||
runner (a locked anchor).
|
||||
|
||||
## Completion Criteria
|
||||
|
||||
- [ ] anonymous `GET /login` → 200 with the form; anonymous `GET /` → 303 to `/login?next=/`
|
||||
- [ ] in the dev server: wrong password shows `Wrong password.` inline with no page reload;
|
||||
`testpass` lands on `/` and the header status dots go green
|
||||
- [ ] five wrong passwords then a correct one shows the lockout with a counting-down
|
||||
`Retry-After` and a disabled button; it clears and the next attempt works
|
||||
- [ ] `/login?next=/ups` after a successful sign-in lands on `/ups`
|
||||
- [ ] dark and light both readable (screenshot both, or one plus a note in `NOTES-*.md`)
|
||||
- [ ] `uv run pytest` green; `ruff` + `pyright` clean; `bash .agents/validate.sh` green
|
||||
Reference in New Issue
Block a user